diff --git a/drasl/config/config.toml.tmpl b/drasl/config/config.toml.tmpl
index 725937f..d782d56 100644
--- a/drasl/config/config.toml.tmpl
+++ b/drasl/config/config.toml.tmpl
@@ -3,7 +3,10 @@
 # -> drasl/config/config.toml (gitignored). Only ${BASE_DOMAIN} is substituted.
 # Reached only via Caddy at auth.${BASE_DOMAIN}; drasl has no published host port.
 
-BaseURL       = "http://auth.${BASE_DOMAIN}"
+# Public scheme is HTTPS — the host nginx terminates TLS in front of caddy.
+# Drasl builds absolute URLs (textures, authlib-injector API location) from this;
+# an http:// value triggers mixed-content + broken login on the https origin.
+BaseURL       = "https://auth.${BASE_DOMAIN}"
 Domain        = "auth.${BASE_DOMAIN}"
 ListenAddress = "0.0.0.0:25585"          # internal; Caddy reverse-proxies to it
 DefaultAdminUsernames = ["admin"]