diff --git a/urapt-web/Caddyfile b/urapt-web/Caddyfile
index 625e0ad..6171b06 100644
--- a/urapt-web/Caddyfile
+++ b/urapt-web/Caddyfile
@@ -6,13 +6,13 @@
 	root * /srv
 
 	handle /api/* {
-		reverse_proxy {$URAPT_SERVER_URL} {
+		reverse_proxy {$URAPT_UPSTREAM} {
 			header_up Host {upstream_hostport}
 		}
 	}
 
 	handle /apt/* {
-		reverse_proxy {$URAPT_SERVER_URL} {
+		reverse_proxy {$URAPT_UPSTREAM} {
 			header_up Host {upstream_hostport}
 		}
 	}
diff --git a/urapt-web/Dockerfile b/urapt-web/Dockerfile
index 4b79af0..b87986a 100644
--- a/urapt-web/Dockerfile
+++ b/urapt-web/Dockerfile
@@ -12,3 +12,6 @@ RUN pnpm build
 FROM caddy:2-alpine
 COPY --from=build /app/dist /srv
 COPY Caddyfile /etc/caddy/Caddyfile
+COPY docker-entrypoint.sh /usr/local/bin/urapt-web-entrypoint
+RUN chmod +x /usr/local/bin/urapt-web-entrypoint
+ENTRYPOINT ["/usr/local/bin/urapt-web-entrypoint"]
diff --git a/urapt-web/README.md b/urapt-web/README.md
index 253207b..b2f95dc 100644
--- a/urapt-web/README.md
+++ b/urapt-web/README.md
@@ -76,6 +76,8 @@ In Railway, create a new service from this repo with:
 - Root Directory: `urapt-web`
 - Environment variable: `URAPT_SERVER_URL=https://your-urapt-server.up.railway.app`
 
+A trailing slash is okay; the container normalizes it before starting Caddy.
+
 Do not set `VITE_API_BASE_URL` for this deployment; the UI should keep using the
 default same-origin `/api/v1` path.
 
diff --git a/urapt-web/docker-entrypoint.sh b/urapt-web/docker-entrypoint.sh
new file mode 100644
index 0000000..0108a73
--- /dev/null
+++ b/urapt-web/docker-entrypoint.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+set -eu
+
+if [ -z "${URAPT_SERVER_URL:-}" ]; then
+  echo "URAPT_SERVER_URL is required, e.g. https://urapt-production.up.railway.app" >&2
+  exit 1
+fi
+
+# Caddy reverse_proxy upstreams may only contain scheme, host, and port.
+# Railway/public URLs are often copied with a trailing slash; normalize that.
+URAPT_UPSTREAM="$URAPT_SERVER_URL"
+while [ "${URAPT_UPSTREAM%/}" != "$URAPT_UPSTREAM" ]; do
+  URAPT_UPSTREAM="${URAPT_UPSTREAM%/}"
+done
+export URAPT_UPSTREAM
+
+exec caddy run --config /etc/caddy/Caddyfile --adapter caddyfile