diff --git a/dashboard/src/routes/apps/[slug]/+page.svelte b/dashboard/src/routes/apps/[slug]/+page.svelte
index 46c1fd4..25a722e 100644
--- a/dashboard/src/routes/apps/[slug]/+page.svelte
+++ b/dashboard/src/routes/apps/[slug]/+page.svelte
@@ -54,6 +54,10 @@
 	let myRole = $state<AppRole | null>(null);
 	let loadError = $state<string | null>(null);
 	let loading = $state(true);
+	/// F-U-014: the canonical public origin (from `/version`). Used to
+	/// build webhook URLs the operator shares with external systems so
+	/// they don't accidentally inherit the admin's LAN address.
+	let publicBaseUrl = $state<string | null>(null);
 	let activeTab = $state<Tab>('scripts');
 
 	let scripts = $state<Script[]>([]);
@@ -379,9 +383,14 @@
 
 	// The inbound-email webhook URL for a given email trigger (shown so
 	// the operator can configure their provider).
+	// F-U-014: prefer the server-known public_base_url (from /version)
+	// so the URL we hand the operator works from outside the admin's
+	// network. Fall back to window.location.origin only if /version
+	// hasn't loaded yet (visibly distinguishable in the UI).
 	function emailInboundUrl(triggerId: string): string {
 		if (!app) return '';
-		return `${window.location.origin}/api/v1/email-inbound/${app.id}/${triggerId}`;
+		const origin = publicBaseUrl ?? window.location.origin;
+		return `${origin.replace(/\/$/, '')}/api/v1/email-inbound/${app.id}/${triggerId}`;
 	}
 
 	async function confirmRemoveTrigger() {
@@ -601,6 +610,12 @@
 		loading = true;
 		loadError = null;
 		try {
+			// F-U-014: fire the /version request alongside the app fetch so
+			// emailInboundUrl can prefer the server-known public_base_url.
+			api
+				.version()
+				.then((v) => (publicBaseUrl = v.public_base_url || null))
+				.catch(() => (publicBaseUrl = null));
 			const fetched = await api.apps.get(slug);
 			if (fetched.redirect_to && fetched.redirect_to !== slug) {
 				await goto(`${base}/apps/${fetched.redirect_to}`, { replaceState: true });
diff --git a/dashboard/src/routes/scripts/[id]/+page.svelte b/dashboard/src/routes/scripts/[id]/+page.svelte
index 5f41150..330b261 100644
--- a/dashboard/src/routes/scripts/[id]/+page.svelte
+++ b/dashboard/src/routes/scripts/[id]/+page.svelte
@@ -417,7 +417,9 @@
 </script>
 
 <section>
-	<a class="back" href={base + '/'}>← Scripts</a>
+	<a class="back" href={appSlug ? `${base}/apps/${appSlug}` : `${base}/apps`}>
+		← {appSlug ?? 'Apps'}
+	</a>
 
 	{#if scriptLoading}
 		<p class="muted">Loading…</p>