diff --git a/packages/codev-gateway/src/const.ts b/packages/codev-gateway/src/const.ts
index ac634866ce..d6bb46894d 100644
--- a/packages/codev-gateway/src/const.ts
+++ b/packages/codev-gateway/src/const.ts
@@ -2,7 +2,12 @@
 // a standalone CoDev Code install can configure the gateway without the hub.
 // Base64 (like the hub) to keep the host out of casual greps, not as a secret.
 const BASE_URL = atob("aHR0cHM6Ly9uZXRtaW5kLnZpZXR0ZWwudm4=")
-export const BACKEND_URL = `${BASE_URL}/codev-backend`
+// `CODEV_BACKEND_URL` points the client at a codev-backend running somewhere
+// else — `bun dev` in that repo serves http://127.0.0.1:8787. Unset in every
+// real install, so the baked URL is what ships. SSO is deliberately NOT
+// overridable: a local backend still verifies tokens against the real
+// provider, so the login flow has to mint a real one.
+export const BACKEND_URL = process.env.CODEV_BACKEND_URL || `${BASE_URL}/codev-backend`
 export const SSO_URL = `${BASE_URL}/sso-wrapper`
 export const LOGIN_SUCCESS_URL = `${BASE_URL}/codev/oauth/success`