diff --git a/.github/workflows/build_containers.yml b/.github/workflows/build_containers.yml
index 905d723..c21f4c0 100644
--- a/.github/workflows/build_containers.yml
+++ b/.github/workflows/build_containers.yml
@@ -49,9 +49,9 @@ jobs:
           set -ux
           echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
           pushd frontend
-          echo "NEXT_PUBLIC_API_URL=http://k8s-wn-01.cam.uchc.edu:30001" > .env
           docker build \
           --no-cache \
+          --build-arg NEXT_PUBLIC_API_URL=/api \
           --file Dockerfile \
           --tag ghcr.io/virtualcell/vcell-ai-frontend:${TAG_NAME} \
           --label org.opencontainers.image.created=${CREATED} \
diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index 47dcb95..cf71e02 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -8,12 +8,17 @@ WORKDIR /app
 COPY package.json package-lock.json* pnpm-lock.yaml* ./
 RUN npm install
 
-# 4. Copy .env file
-COPY .env ./
-
-# 5. Copy the rest of the app
+# 4. Copy the rest of the app
 COPY . .
 
+# 5. NEXT_PUBLIC_* vars are inlined into the browser bundle at build time. Default
+# to a RELATIVE "/api" so the browser calls the same origin it's served from — the
+# ingress routes /api -> backend — which makes ONE image work in every environment
+# (dev/prod/local). Override with --build-arg NEXT_PUBLIC_API_URL=<absolute-url>
+# only if the frontend is served on a different origin than the API.
+ARG NEXT_PUBLIC_API_URL=/api
+ENV NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL}
+
 # 6. Expose the dev server port
 EXPOSE 3000