diff --git a/roles/web-app-opencloud/vars/main.yml b/roles/web-app-opencloud/vars/main.yml
index 3b377cbfa4..9092355462 100644
--- a/roles/web-app-opencloud/vars/main.yml
+++ b/roles/web-app-opencloud/vars/main.yml
@@ -4,15 +4,12 @@ entity_name: "{{ application_id | get_entity_name }}"
 
 OPENCLOUD_CONTAINER: "{{ lookup('config', application_id, 'services.opencloud.name') }}"
 
-OPENCLOUD_URL: "{{ lookup('tls', application_id, 'url.base') }}"
+OPENCLOUD_URL: "{{ lookup('tls', application_id, 'url.base') | regex_replace('/+$', '') }}"
 OPENCLOUD_DOMAIN: "{{ lookup('domain', application_id) }}"
 
-# IAM toggles consumed by env.j2
 OPENCLOUD_OIDC_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"
 OPENCLOUD_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') }}"
 
-# Initial admin password (only used while IDM is built-in; with external IdP it
-# remains a fallback for emergency local console access).
 OPENCLOUD_ADMIN_PASSWORD: "{{ lookup('config', application_id, 'credentials.administrator_password') }}"
 
 OPENCLOUD_MACHINE_AUTH_API_KEY: "{{ lookup('config', application_id, 'credentials.machine_auth_api_key') }}"
@@ -20,9 +17,6 @@ OPENCLOUD_STORAGE_SYSTEM_JWT_SECRET: "{{ lookup('config', application_id, 'crede
 OPENCLOUD_JWT_SECRET: "{{ lookup('config', application_id, 'credentials.jwt_secret') }}"
 OPENCLOUD_TRANSFER_SECRET: "{{ lookup('config', application_id, 'credentials.transfer_secret') }}"
 
-# Cross-link to OpenTalk (used by env to expose meeting launcher).
-# `tls` lookup raises when the role is not in scope, so gate the URL behind
-# the group_names check and fall back to an empty string when OpenTalk is
-# not part of the current host's role set.
+# Exception: the tls lookup raises when web-app-opentalk is not in scope
 OPENCLOUD_OPENTALK_ENABLED: "{{ ('web-app-opentalk' in group_names) | lower }}"
 OPENCLOUD_OPENTALK_URL: "{{ lookup('tls', 'web-app-opentalk', 'url.base') if OPENCLOUD_OPENTALK_ENABLED | bool else '' }}"