diff --git a/.env.example b/.env.example
index 5e9c677..1da0198 100644
--- a/.env.example
+++ b/.env.example
@@ -3,7 +3,7 @@ NODE_ENV=development
 API_PORT=3000
 WEB_PORT=4200
 PUBLIC_WEB_URL=http://localhost:4200
-API_BASE_URL=
+API_BASE_URL=/api
 
 DATABASE_URL=mysql://ldap_portal:change-me@mysql.example.com:3306/ldap_portal
 DATABASE_SSL=false
diff --git a/README.md b/README.md
index b39318f..3870b91 100644
--- a/README.md
+++ b/README.md
@@ -58,7 +58,7 @@ docker run -d --name ldap-portal-idp \
   registry.example.com/ldap-portal/idp:latest
 ```
 
-Standardmaessig bleibt `API_BASE_URL` leer. Das Frontend nutzt dadurch relative URLs und Nginx routet API-/OIDC-Pfade intern zur NestJS-API. Setze `API_BASE_URL` nur, wenn das Frontend bewusst eine andere API-Origin verwenden soll.
+Standardmaessig ist `API_BASE_URL=/api`. Das Frontend ruft damit Backend-Endpunkte unter `/api/...` auf, waehrend Nginx den Prefix intern entfernt und zur NestJS-API routet. Dadurch bleiben Angular-Routen wie `/account` und `/admin/users` auch nach einem Browser-Refresh SPA-Routen. Setze `API_BASE_URL` nur anders, wenn das Frontend bewusst eine andere API-Origin verwenden soll; bei Single-Container-Deployments sollte `/api` bleiben.
 
 ## Externe Dienste
 
diff --git a/apps/web/proxy.conf.json b/apps/web/proxy.conf.json
index 175691e..ec0bb25 100644
--- a/apps/web/proxy.conf.json
+++ b/apps/web/proxy.conf.json
@@ -14,29 +14,12 @@
     "secure": false,
     "changeOrigin": true
   },
-  "/auth": {
+  "/api": {
     "target": "http://localhost:3000",
     "secure": false,
-    "changeOrigin": true
-  },
-  "/account": {
-    "target": "http://localhost:3000",
-    "secure": false,
-    "changeOrigin": true
-  },
-  "/admin": {
-    "target": "http://localhost:3000",
-    "secure": false,
-    "changeOrigin": true
-  },
-  "/password": {
-    "target": "http://localhost:3000",
-    "secure": false,
-    "changeOrigin": true
-  },
-  "/registration": {
-    "target": "http://localhost:3000",
-    "secure": false,
-    "changeOrigin": true
+    "changeOrigin": true,
+    "pathRewrite": {
+      "^/api": ""
+    }
   }
 }
diff --git a/apps/web/src/app/pages/admin-oidc-clients.component.ts b/apps/web/src/app/pages/admin-oidc-clients.component.ts
index d16ca16..61a6052 100644
--- a/apps/web/src/app/pages/admin-oidc-clients.component.ts
+++ b/apps/web/src/app/pages/admin-oidc-clients.component.ts
@@ -83,11 +83,11 @@ interface CreatedOidcClient extends OidcClient {
         <article class="info-panel">
           <h2>Discovery</h2>
           <dl>
-            <div><dt>Configuration</dt><dd>{{ apiBaseUrl }}/.well-known/openid-configuration</dd></div>
-            <div><dt>Authorize</dt><dd>{{ apiBaseUrl }}/oidc/auth</dd></div>
-            <div><dt>Token</dt><dd>{{ apiBaseUrl }}/oidc/token</dd></div>
-            <div><dt>UserInfo</dt><dd>{{ apiBaseUrl }}/oidc/me</dd></div>
-            <div><dt>JWKS</dt><dd>{{ apiBaseUrl }}/oidc/jwks</dd></div>
+            <div><dt>Configuration</dt><dd>{{ oidcBaseUrl }}/.well-known/openid-configuration</dd></div>
+            <div><dt>Authorize</dt><dd>{{ oidcBaseUrl }}/oidc/auth</dd></div>
+            <div><dt>Token</dt><dd>{{ oidcBaseUrl }}/oidc/token</dd></div>
+            <div><dt>UserInfo</dt><dd>{{ oidcBaseUrl }}/oidc/me</dd></div>
+            <div><dt>JWKS</dt><dd>{{ oidcBaseUrl }}/oidc/jwks</dd></div>
           </dl>
         </article>
       </section>
@@ -134,6 +134,7 @@ export class AdminOidcClientsComponent implements OnInit {
   readonly failed = signal(false);
   readonly message = signal('');
   readonly createdSecret = signal('');
+  readonly oidcBaseUrl: string;
   readonly form;
 
   constructor(
@@ -141,6 +142,7 @@ export class AdminOidcClientsComponent implements OnInit {
     private readonly http: HttpClient,
     @Inject(API_BASE_URL) readonly apiBaseUrl: string,
   ) {
+    this.oidcBaseUrl = apiBaseUrl.endsWith('/api') ? apiBaseUrl.slice(0, -4) : apiBaseUrl;
     this.form = this.fb.nonNullable.group({
       clientName: ['', Validators.required],
       redirectUris: ['http://localhost:8080/callback', Validators.required],
diff --git a/apps/web/src/config.js b/apps/web/src/config.js
index f3fd954..d47cab2 100644
--- a/apps/web/src/config.js
+++ b/apps/web/src/config.js
@@ -1,3 +1,3 @@
 window.__LDAP_PORTAL_CONFIG__ = {
-  apiBaseUrl: ''
+  apiBaseUrl: '/api'
 };
diff --git a/apps/web/src/main.ts b/apps/web/src/main.ts
index 307098f..cb36282 100644
--- a/apps/web/src/main.ts
+++ b/apps/web/src/main.ts
@@ -66,6 +66,6 @@ bootstrapApplication(AppComponent, {
     provideRouter(routes),
     provideHttpClient(withInterceptors([authInterceptor])),
     AuthService,
-    { provide: API_BASE_URL, useValue: window.__LDAP_PORTAL_CONFIG__?.apiBaseUrl ?? '' },
+    { provide: API_BASE_URL, useValue: window.__LDAP_PORTAL_CONFIG__?.apiBaseUrl ?? '/api' },
   ],
 }).catch((error) => console.error(error));
diff --git a/docker/single-container.nginx.conf b/docker/single-container.nginx.conf
index cbbbb07..cea8c11 100644
--- a/docker/single-container.nginx.conf
+++ b/docker/single-container.nginx.conf
@@ -26,24 +26,8 @@ server {
     proxy_pass http://127.0.0.1:3000;
   }
 
-  location /auth/ {
-    proxy_pass http://127.0.0.1:3000;
-  }
-
-  location /account/ {
-    proxy_pass http://127.0.0.1:3000;
-  }
-
-  location /admin/ {
-    proxy_pass http://127.0.0.1:3000;
-  }
-
-  location /password/ {
-    proxy_pass http://127.0.0.1:3000;
-  }
-
-  location /registration/ {
-    proxy_pass http://127.0.0.1:3000;
+  location /api/ {
+    proxy_pass http://127.0.0.1:3000/;
   }
 
   location / {
diff --git a/docker/start-single-container.sh b/docker/start-single-container.sh
index f92301f..fc78f84 100644
--- a/docker/start-single-container.sh
+++ b/docker/start-single-container.sh
@@ -3,7 +3,7 @@ set -eu
 
 cat >/usr/share/nginx/html/config.js <<EOF
 window.__LDAP_PORTAL_CONFIG__ = {
-  apiBaseUrl: "${API_BASE_URL:-}"
+  apiBaseUrl: "${API_BASE_URL:-/api}"
 };
 EOF