diff --git a/frontend/src/main.ts b/frontend/src/main.ts
index 960dcf1..dae0915 100644
--- a/frontend/src/main.ts
+++ b/frontend/src/main.ts
@@ -189,7 +189,8 @@ function renderPresence() {
 
 async function refreshSchedule() {
   try {
-    const res = await fetch("/api/schedule");
+    const apiUrl = import.meta.env.VITE_PUBLIC_APP_URL?.trim() || window.location.origin;
+    const res = await fetch(`${apiUrl}/api/schedule`);
     if (!res.ok) return;
     const data = await res.json();
     const entries = data.entries as Array<{ title: string; status: string }>;
@@ -355,11 +356,15 @@ function togglePrivateDM() {
 }
 
 async function searchDM() {
+  const apiUrl = import.meta.env.VITE_PUBLIC_APP_URL?.trim() || window.location.origin;
   const input = document.getElementById("dm-search-input") as HTMLInputElement;
   const q = input.value.trim();
   if (!q || !currentDMTarget) return;
   try {
-    const res = await fetch(`/api/dm/search?with=${encodeURIComponent(currentDMTarget)}&q=${encodeURIComponent(q)}`);
+    const res = await fetch(
+      `${apiUrl}/api/dm/search?with=${encodeURIComponent(currentDMTarget)}&q=${encodeURIComponent(q)}`,
+      { credentials: "include" },
+    );
     if (!res.ok) return;
     const results = await res.json();
     addMessage("system", `Search results (${results.length}) for "${q}":`);
@@ -392,7 +397,8 @@ function updateAuthUI() {
 
 async function refreshUserSession() {
   try {
-    const res = await fetch("/api/auth/session");
+    const apiUrl = import.meta.env.VITE_PUBLIC_APP_URL?.trim() || window.location.origin;
+    const res = await fetch(`${apiUrl}/api/auth/session`, { credentials: "include" });
     if (!res.ok) return;
     const data = await res.json();
     const wasAnonymous = username.startsWith("viewer");
@@ -458,7 +464,8 @@ function register() {
 
 async function logout() {
   try {
-    await fetch("/api/auth/logout", { method: "POST" });
+    const apiUrl = import.meta.env.VITE_PUBLIC_APP_URL?.trim() || window.location.origin;
+    await fetch(`${apiUrl}/api/auth/logout`, { method: "POST", credentials: "include" });
   } catch {
     /* ignore */
   }