diff --git a/Dockerfile b/Dockerfile
index 41ca849..c110790 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -88,8 +88,10 @@ COPY --from=cm6-build /build/dist/ /usr/share/nginx/html/vendor/codemirror/
 # Builtin extensions (seeded into DB on startup by backend)
 COPY extensions/builtin/ /app/extensions/builtin/
 
-# nginx config
-COPY nginx.conf /etc/nginx/conf.d/default.conf
+# nginx config (template — envsubst injects BASE_PATH at runtime)
+COPY nginx.conf.template /etc/nginx/templates/default.conf.template
+# Only substitute BASE_PATH — preserve nginx variables ($host, $uri, etc.)
+ENV NGINX_ENVSUBST_FILTER="BASE_PATH"
 
 # Entrypoint: start Go backend, then nginx
 COPY docker-entrypoint.sh /docker-entrypoint.d/90-start-backend.sh
diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh
index 6b255d5..413a96a 100644
--- a/docker-entrypoint.sh
+++ b/docker-entrypoint.sh
@@ -9,6 +9,17 @@
 
 set -e
 
+# Inject BASE_PATH into frontend HTML/JS at runtime
+if [ -n "${BASE_PATH}" ]; then
+    echo "🔧 Injecting BASE_PATH=${BASE_PATH} into frontend assets..."
+    find /usr/share/nginx/html -type f \( -name '*.html' -o -name '*.js' \) \
+        -exec sed -i "s|%%BASE_PATH%%|${BASE_PATH}|g" {} +
+else
+    # No prefix — strip the placeholder entirely
+    find /usr/share/nginx/html -type f \( -name '*.html' -o -name '*.js' \) \
+        -exec sed -i "s|%%BASE_PATH%%||g" {} +
+fi
+
 echo "🔀 Starting Switchboard Core backend..."
 
 # Launch Go backend in background (from /app so migrations are found)
diff --git a/nginx.conf b/nginx.conf.template
similarity index 68%
rename from nginx.conf
rename to nginx.conf.template
index d65af94..ae03f66 100644
--- a/nginx.conf
+++ b/nginx.conf.template
@@ -24,7 +24,7 @@ server {
     }
 
     # ── API + WebSocket → backend ────────────
-    location ^~ /api/ {
+    location ^~ ${BASE_PATH}/api/ {
         proxy_pass $backend;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
@@ -33,15 +33,15 @@ server {
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 
-    location = /health {
+    location = ${BASE_PATH}/health {
         proxy_pass $backend;
     }
 
-    location = /metrics {
+    location = ${BASE_PATH}/metrics {
         proxy_pass $backend;
     }
 
-    location = /ws {
+    location = ${BASE_PATH}/ws {
         proxy_pass $backend;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
@@ -53,8 +53,8 @@ server {
         proxy_send_timeout 86400s;
     }
 
-    # ── Page routes → backend (Go templates) ─
-    location = / {
+    # ── Page routes → backend (Go renders HTML) ─
+    location = ${BASE_PATH}/ {
         proxy_pass $backend;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
@@ -62,19 +62,19 @@ server {
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 
-    location = /login {
+    location = ${BASE_PATH}/login {
         proxy_pass $backend;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
     }
 
-    location /admin  { proxy_pass $backend; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; }
-    location /team-admin { proxy_pass $backend; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; }
-    location /settings { proxy_pass $backend; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; }
-    location /w/     { proxy_pass $backend; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; }
+    location ${BASE_PATH}/admin  { proxy_pass $backend; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; }
+    location ${BASE_PATH}/team-admin { proxy_pass $backend; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; }
+    location ${BASE_PATH}/settings { proxy_pass $backend; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; }
+    location ${BASE_PATH}/w/     { proxy_pass $backend; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; }
 
-    # v0.27.0: Extension surface page routes → backend (Go templates)
-    location /s/ {
+    # Extension surface page routes → backend
+    location ${BASE_PATH}/s/ {
         proxy_pass $backend;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
@@ -82,18 +82,16 @@ server {
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 
-    # v0.27.0: Extension surface static assets (JS, CSS, images)
-    # v0.28.7: On-disk path moved to /data/packages/, URL retained for stability.
-    # v0.29.2: ^~ prefix beats regex; corrected alias to /data/storage/packages/.
-    location ^~ /surfaces/ {
+    # Extension surface static assets
+    location ^~ ${BASE_PATH}/surfaces/ {
         alias /data/storage/packages/;
         expires off;
         add_header Cache-Control "no-cache";
     }
 
-    # Fallback: redirect unknown paths to root
-    location / {
-        try_files $uri $uri/ /index.html;
+    # Fallback: serve frontend shell (SPA)
+    location ${BASE_PATH}/ {
+        try_files $uri $uri/ ${BASE_PATH}/index.html;
     }
 
     # Security headers