diff --git a/plugins/lookup/tls.py b/plugins/lookup/tls.py
index 03de01439a..871986a7b0 100644
--- a/plugins/lookup/tls.py
+++ b/plugins/lookup/tls.py
@@ -99,7 +99,8 @@ class LookupModule(LookupBase):
         web_protocol = "https" if enabled else "http"
         websocket_protocol = "wss" if enabled else "ws"
         web_port = 443 if enabled else 80
-        base_url = f"{web_protocol}://{primary_domain}/"
+        origin = f"{web_protocol}://{primary_domain}"
+        base_url = f"{origin}/"
 
         resolved: dict[str, Any] = {
             "application_id": app_id,
@@ -109,7 +110,7 @@ class LookupModule(LookupBase):
             "domains": {"primary": primary_domain, "all": all_domains},
             "protocols": {"web": web_protocol, "websocket": websocket_protocol},
             "ports": {"web": web_port},
-            "url": {"base": base_url},
+            "url": {"base": base_url, "origin": origin},
         }
 
         if want:
diff --git a/roles/web-app-fider/templates/env.j2 b/roles/web-app-fider/templates/env.j2
index 30ebb09da2..38abb69ce7 100644
--- a/roles/web-app-fider/templates/env.j2
+++ b/roles/web-app-fider/templates/env.j2
@@ -1,6 +1,6 @@
 {% include 'roles/sys-svc-container/templates/env.j2' %}
 
-BASE_URL={{ lookup('tls', application_id, 'url.base') }}
+BASE_URL={{ lookup('tls', application_id, 'url.origin') }}
 DATABASE_URL=postgresql://{{ lookup('database', application_id, 'username') }}:{{ lookup('database', application_id, 'password') }}@{{ lookup('database', application_id, 'host') }}:{{ lookup('database', application_id, 'port') }}/{{ lookup('database', application_id, 'name') }}?sslmode=disable
 JWT_SECRET={{ (application_id ~ lookup('users', 'administrator').password) | hash('sha256') }}
 
diff --git a/tests/unit/python/plugins/lookup/test_tls.py b/tests/unit/python/plugins/lookup/test_tls.py
index af91c312e7..0cd80fcbb7 100644
--- a/tests/unit/python/plugins/lookup/test_tls.py
+++ b/tests/unit/python/plugins/lookup/test_tls.py
@@ -85,6 +85,16 @@ class TestTlsResolveLookup(unittest.TestCase):
         )[0]
         self.assertEqual(val, "https://a.example/")
 
+    def test_url_origin_is_the_base_url_without_its_trailing_slash(self):
+        origin, base = (
+            self.lookup.run(["web-app-a", want], variables=self.base_vars, mode="app")[
+                0
+            ]
+            for want in ("url.origin", "url.base")
+        )
+        self.assertEqual(origin, "https://a.example")
+        self.assertEqual(f"{origin}/", base)
+
     def test_protocols_web_path_is_http_for_an_onion_only_app(self):
         onion = dict(self.base_vars)
         onion["domains"] = {**self.domains, "web-app-onion": "abc123.onion"}