diff --git a/ansible/roles/semaphore/defaults/main.yml b/ansible/roles/semaphore/defaults/main.yml
index 0265511..ce52dcc 100644
--- a/ansible/roles/semaphore/defaults/main.yml
+++ b/ansible/roles/semaphore/defaults/main.yml
@@ -38,8 +38,12 @@ semaphore_postgres_volume: semaphore_postgres_data
 semaphore_listen_address: "0.0.0.0"
 semaphore_listen_port: 3000
 
-# Public URL (used by Semaphore for OIDC redirects, webhook URLs, etc.)
-semaphore_web_url: "https://semaphore.local.mk-labs.cloud"
+# Public URL used for Semaphore-generated absolute URLs (webhooks, OIDC
+# callbacks, etc). Leave EMPTY to make Semaphore host-agnostic — the SPA
+# then uses relative URLs and serves cleanly under any hostname Traefik
+# points at it. Set to a fully-qualified URL only if a specific feature
+# requires an absolute base.
+semaphore_web_url: ""
 
 # ---------------------------------------------------------------------------
 # PostgreSQL configuration
diff --git a/ansible/roles/semaphore/templates/semaphore.container.j2 b/ansible/roles/semaphore/templates/semaphore.container.j2
index 3a8f241..25da30f 100644
--- a/ansible/roles/semaphore/templates/semaphore.container.j2
+++ b/ansible/roles/semaphore/templates/semaphore.container.j2
@@ -39,7 +39,10 @@ Environment=SEMAPHORE_PLAYBOOK_PATH=/var/lib/semaphore/playbooks
 Environment=SEMAPHORE_ACCESS_KEY_ENCRYPTION={{ semaphore_access_key_encryption }}
 
 # Public-facing URL used for OIDC redirects, webhooks, etc.
+# Empty string keeps Semaphore host-agnostic (relative URLs).
+{% if semaphore_web_url | length > 0 %}
 Environment=SEMAPHORE_WEB_ROOT={{ semaphore_web_url }}
+{% endif %}
 
 # Timezone matches host baseline
 Environment=TZ=America/Chicago