diff --git a/roles/web-app-moodle/files/build/config.php b/roles/web-app-moodle/files/build/config.php
index 8f5f7d9270..cef8461f34 100644
--- a/roles/web-app-moodle/files/build/config.php
+++ b/roles/web-app-moodle/files/build/config.php
@@ -43,6 +43,12 @@ $CFG->directorypermissions = 02770;
 $CFG->reverseproxy = moodle_env_bool('MOODLE_REVERSEPROXY');
 $CFG->sslproxy     = moodle_env_bool('MOODLE_SSLPROXY');
 
+$_moodle_internal_host = moodle_env('MOODLE_INTERNAL_HOST');
+if (explode(':', $_SERVER['HTTP_HOST'] ?? '', 2)[0] === $_moodle_internal_host) {
+    $_SERVER['HTTP_HOST']   = parse_url($CFG->wwwroot, PHP_URL_HOST);
+    $_SERVER['SERVER_NAME'] = $_SERVER['HTTP_HOST'];
+}
+
 $_moodle_debug     = moodle_env_bool('MOODLE_DEBUG');
 $CFG->debug        = $_moodle_debug ? 32767 : 0;
 $CFG->debugdisplay = $_moodle_debug;
diff --git a/roles/web-app-moodle/files/build/moodle-entrypoint.sh b/roles/web-app-moodle/files/build/moodle-entrypoint.sh
index 025cd512c7..ae9ba95b9d 100644
--- a/roles/web-app-moodle/files/build/moodle-entrypoint.sh
+++ b/roles/web-app-moodle/files/build/moodle-entrypoint.sh
@@ -37,6 +37,14 @@ moodle_bootstrap_code_dir() {
   touch "${MOODLE_BOOTSTRAP_SENTINEL}"
 }
 
+moodle_refresh_config() {
+	if [ -f "${MOODLE_SOURCE_DIR}/config.php" ]; then
+		cp -f "${MOODLE_SOURCE_DIR}/config.php" "${MOODLE_CODE_DIR}/config.php" || true
+		chown "${MOODLE_RUNTIME_USER}:${MOODLE_RUNTIME_USER}" "${MOODLE_CODE_DIR}/config.php" || true
+		chmod 0640 "${MOODLE_CODE_DIR}/config.php" || true
+	fi
+}
+
 mkdir -p "${MOODLE_CODE_DIR}"
 while [ ! -f "${MOODLE_BOOTSTRAP_SENTINEL}" ]; do
   exec 9>>"${MOODLE_BOOTSTRAP_LOCK}"
@@ -48,6 +56,8 @@ while [ ! -f "${MOODLE_BOOTSTRAP_SENTINEL}" ]; do
   exec 9>&-
 done
 
+moodle_refresh_config
+
 if [ "$(id -u)" -eq 0 ] && [ "${1:-}" != "php-fpm" ]; then
   exec gosu "${MOODLE_RUNTIME_USER}" "$@"
 fi
diff --git a/roles/web-app-moodle/tasks/utils/mcp.yml b/roles/web-app-moodle/tasks/utils/mcp.yml
index f34c27eab1..3fb3fadaf7 100644
--- a/roles/web-app-moodle/tasks/utils/mcp.yml
+++ b/roles/web-app-moodle/tasks/utils/mcp.yml
@@ -22,4 +22,4 @@
     mcp_probe_path_key: ""
     mcp_probe_read_tool: "core_course_get_courses"
     mcp_probe_read_args: {}
-    mcp_probe_host: "{{ MOODLE_DOMAIN }}"
+    mcp_probe_host: ""
diff --git a/roles/web-app-moodle/tasks/utils/mcp/verify.yml b/roles/web-app-moodle/tasks/utils/mcp/verify.yml
index 4ca5b1f20e..29ad45fe35 100644
--- a/roles/web-app-moodle/tasks/utils/mcp/verify.yml
+++ b/roles/web-app-moodle/tasks/utils/mcp/verify.yml
@@ -6,8 +6,6 @@
         -X POST \
         -H 'Content-Type: application/json' \
         -H 'Accept: application/json' \
-        -H {{ ('Host: ' ~ MOODLE_DOMAIN) | quote }} \
-        -H 'X-Forwarded-Proto: https' \
         -H {{ ('Authorization: Bearer ' ~ moodle_mcp_token) | quote }} \
         --data-binary {{ MOODLE_MCP_TOOLS_LIST_PAYLOAD | to_json | quote }} \
         {{ MOODLE_MCP_URL | quote }}
diff --git a/roles/web-app-moodle/templates/env.j2 b/roles/web-app-moodle/templates/env.j2
index 2487b71613..61887a1cac 100644
--- a/roles/web-app-moodle/templates/env.j2
+++ b/roles/web-app-moodle/templates/env.j2
@@ -1,6 +1,7 @@
 {% include 'roles/sys-svc-container/templates/env.j2' %}
 
 MOODLE_WWWROOT={{ lookup('tls', application_id, 'url.base') | regex_replace('/$', '') }}
+MOODLE_INTERNAL_HOST={{ MOODLE_MCP_SERVICE_KEY }}
 MOODLE_DATAROOT={{ MOODLE_DATA_DIR }}
 MOODLE_LOCALCACHEDIR={{ MOODLE_LOCAL_CACHE_DIR }}