diff --git a/roles/web-app-bluesky/tasks/02_social_app.yml b/roles/web-app-bluesky/tasks/02_social_app.yml
index d3e11800..518a498c 100644
--- a/roles/web-app-bluesky/tasks/02_social_app.yml
+++ b/roles/web-app-bluesky/tasks/02_social_app.yml
@@ -16,3 +16,12 @@
   notify:
     - docker compose build
     - docker compose up
+
+- name: Force IPCC_URL to same-origin /ipcc
+  ansible.builtin.replace:
+    path: "{{ BLUESKY_SOCIAL_APP_DIR }}/src/state/geolocation.tsx"
+    regexp: '^\s*const\s+IPCC_URL\s*=\s*.*$'
+    replace: "const IPCC_URL = '/ipcc'"
+  notify:
+    - docker compose build
+    - docker compose up
diff --git a/roles/web-app-bluesky/templates/extra_locations.conf.j2 b/roles/web-app-bluesky/templates/extra_locations.conf.j2
index 11d41cfd..2c14937e 100644
--- a/roles/web-app-bluesky/templates/extra_locations.conf.j2
+++ b/roles/web-app-bluesky/templates/extra_locations.conf.j2
@@ -13,4 +13,17 @@ location = /config {
     proxy_hide_header Access-Control-Allow-Origin;
     add_header Access-Control-Allow-Origin $scheme://$host always;
     add_header Vary Origin always;
-}
\ No newline at end of file
+}
+
+location = /ipcc {
+    proxy_pass https://bsky.app/ipcc;
+    set $up_host "bsky.app";
+    proxy_set_header Host $up_host;
+    proxy_http_version 1.1;
+    proxy_set_header Connection "";
+    proxy_ssl_server_name on;
+
+    proxy_hide_header Access-Control-Allow-Origin;
+    add_header Access-Control-Allow-Origin $scheme://$host always;
+    add_header Vary Origin always;
+}