diff --git a/scripts/deploy-production.sh b/scripts/deploy-production.sh
index 5363b3c..16262f6 100755
--- a/scripts/deploy-production.sh
+++ b/scripts/deploy-production.sh
@@ -94,7 +94,23 @@ for dir in "${DIRS[@]}"; do
             exit 1
         fi
 
-        asset_scheme="$(curl -fsS "${health_url%/up}/login" | grep -oE 'https?://[^"'\'' ]+\.css' | head -1 || true)"
+        # Hit /login as the public HTTPS edge would (trustProxies needs forwarded proto).
+        app_url="$(awk -F= '/^APP_URL=/ {print $2; exit}' .env 2>/dev/null || true)"
+        app_url="${app_url:-https://transcribe.z00.nu}"
+        public_host="$(python3 - <<PY
+from urllib.parse import urlparse
+print(urlparse("${app_url}").hostname or "transcribe.z00.nu")
+PY
+)"
+        asset_scheme="$(
+            curl -fsS \
+                -H "X-Forwarded-Proto: https" \
+                -H "X-Forwarded-Host: ${public_host}" \
+                -H "X-Forwarded-Port: 443" \
+                "http://127.0.0.1:${app_port}/login" \
+            | grep -oE 'https?://[^"'\'' ]+\.css' \
+            | head -1 || true
+        )"
         if [[ "${asset_scheme}" == http://* ]]; then
             echo "ERROR: login page still emits http:// asset URLs (${asset_scheme})" >&2
             exit 1