diff --git a/.env.dev b/.env.dev
index 9dc4b1d0..c36b1736 100644
--- a/.env.dev
+++ b/.env.dev
@@ -6,8 +6,9 @@ POD_NAME="dev-router-pod"
 
 # Public URLs
 BASEURL="dev.vendeuvre.lan"
-BASE_URL="dev.vendeuvre.lan"
-PUBLIC_BASE_URL="https://dev.vendeuvre.lan/llm-routing"
+PUBLIC_BASE_URL="https://dev.vendeuvre.lan"
+PROXY_BASE_URL="https://litellm.dev.vendeuvre.lan"
+NEXTAUTH_URL="https://langfuse.dev.vendeuvre.lan"
 
 # Dev port assignments (+10 offset from production)
 ROUTER_PORT="5010"
diff --git a/router/main.py b/router/main.py
index 567f6f09..d2c88638 100644
--- a/router/main.py
+++ b/router/main.py
@@ -3546,21 +3546,15 @@ def resolve_external_urls(request: Request) -> tuple[str, str, str]:
     is_valid_external = external_host == domain or external_host.endswith("." + domain)
     is_valid_base = request.base_url.hostname == domain or (request.base_url.hostname or "").endswith("." + domain)
 
-    if is_valid_external:
-        # Centralized base URL path under subdomain/reverse proxy
+    if is_valid_external or is_valid_base:
+        host_val = external_host if is_valid_external else (request.base_url.hostname or "vendeuvre.lan")
+        host_base = host_val.replace("dashboard.", "")
+        if host_base.startswith("litellm.") or host_base.startswith("langfuse.") or host_base.startswith("llama."):
+            host_base = re.sub(r"^(litellm|langfuse|llama)\.", "", host_base)
         return (
-            f"{external_scheme}://{external_netloc}/llm-routing/langfuse",
-            f"{external_scheme}://{external_netloc}/llm-routing/litellm/ui",
-            f"{external_scheme}://{external_netloc}/llm-routing/llama/"
-        )
-    elif is_valid_base:
-        parsed_netloc = urlparse(f"{external_scheme}://{request.url.netloc}")
-        netloc = request.url.netloc if parsed_netloc.hostname else "localhost"
-        base = f"{external_scheme}://{netloc}"
-        return (
-            f"{base}/llm-routing/langfuse",
-            f"{base}/llm-routing/litellm/ui",
-            f"{base}/llm-routing/llama/"
+            f"{external_scheme}://langfuse.{host_base}",
+            f"{external_scheme}://litellm.{host_base}/ui/",
+            f"{external_scheme}://llama.{host_base}/"
         )
     else:
         # Local development fallback: derive schemes, ports, and paths dynamically from configuration constants
diff --git a/start-stack.sh b/start-stack.sh
index 6087a442..a3431cf6 100755
--- a/start-stack.sh
+++ b/start-stack.sh
@@ -698,13 +698,24 @@ text = text.replace("MINIO_PASSWORD_PLACEHOLDER", yaml_scalar(os.environ["MINIO_
 text = text.replace("LANGFUSE_INIT_USER_PASSWORD_PLACEHOLDER", yaml_scalar(os.environ["LANGFUSE_INIT_USER_PASSWORD"]))
 text = text.replace("REDIS_AUTH_PLACEHOLDER", yaml_scalar(os.environ["REDIS_AUTH"]))
 text = text.replace("CLICKHOUSE_PASSWORD_PLACEHOLDER", yaml_scalar(os.environ["CLICKHOUSE_PASSWORD"]))
-# Derive PROXY_BASE_URL from PUBLIC_BASE_URL
+# Derive PROXY_BASE_URL and NEXTAUTH_URL (favoring explicit env or subdomain formatting)
 public_base_url = os.environ["PUBLIC_BASE_URL"].rstrip("/")
-proxy_base_url = f"{public_base_url}/litellm"
+parsed_pub = urllib.parse.urlparse(public_base_url)
+scheme = parsed_pub.scheme or "https"
+host = parsed_pub.netloc or parsed_pub.path.split("/")[0] or "vendeuvre.lan"
+
+if "PROXY_BASE_URL" in os.environ:
+    proxy_base_url = os.environ["PROXY_BASE_URL"]
+else:
+    proxy_base_url = f"{scheme}://litellm.{host}"
+
+if "NEXTAUTH_URL" in os.environ:
+    nextauth_url = os.environ["NEXTAUTH_URL"]
+else:
+    nextauth_url = f"{scheme}://langfuse.{host}"
+
 text = text.replace("PROXY_BASE_URL_PLACEHOLDER", yaml_scalar(proxy_base_url))
 text = text.replace("PUBLIC_BASE_URL_PLACEHOLDER", yaml_scalar(os.environ["PUBLIC_BASE_URL"]))
-# Derive NEXTAUTH_URL from PUBLIC_BASE_URL (Langfuse needs the public URL for OAuth redirects)
-nextauth_url = f"{public_base_url}/langfuse"
 text = text.replace("NEXTAUTH_URL_PLACEHOLDER", yaml_scalar(nextauth_url))
 text = text.replace("ROUTING_DOMAIN_PLACEHOLDER", yaml_scalar(os.environ["ROUTING_DOMAIN"]))
 # Raw replacements (no quoting — used for pod name, data root, and integer port values)