diff --git a/.github/workflows/components-build-deploy.yml b/.github/workflows/components-build-deploy.yml
index d143ffe6d..d466290d4 100755
--- a/.github/workflows/components-build-deploy.yml
+++ b/.github/workflows/components-build-deploy.yml
@@ -400,6 +400,7 @@ jobs:
         run: |
           oc set env deployment/frontend -n ambient-code -c frontend \
             GITHUB_APP_SLUG="ambient-code-stage" \
+            GITHUB_CALLBACK_URL="https://ambient-code.apps.rosa.vteam-stage.7fpc.p3.openshiftapps.com/api/auth/github/user/callback" \
             FEEDBACK_URL="https://forms.gle/7XiWrvo6No922DUz6"
 
       - name: Update operator environment variables
@@ -477,6 +478,7 @@ jobs:
         run: |
           oc set env deployment/frontend -n ambient-code -c frontend \
             GITHUB_APP_SLUG="ambient-code-stage" \
+            GITHUB_CALLBACK_URL="https://ambient-code.apps.rosa.vteam-stage.7fpc.p3.openshiftapps.com/api/auth/github/user/callback" \
             FEEDBACK_URL="https://forms.gle/7XiWrvo6No922DUz6"
 
       - name: Update operator environment variables
diff --git a/.github/workflows/prod-release-deploy.yaml b/.github/workflows/prod-release-deploy.yaml
index 2c13b5384..586d85120 100755
--- a/.github/workflows/prod-release-deploy.yaml
+++ b/.github/workflows/prod-release-deploy.yaml
@@ -689,6 +689,7 @@ jobs:
         run: |
           oc set env deployment/frontend -n ambient-code -c frontend \
             GITHUB_APP_SLUG="ambient-code" \
+            GITHUB_CALLBACK_URL="https://ambient-code.apps.rosa.vteam-uat.0ksl.p3.openshiftapps.com/api/auth/github/user/callback" \
             FEEDBACK_URL="https://forms.gle/7XiWrvo6No922DUz6"
 
       - name: Update operator environment variables
diff --git a/components/frontend/README.md b/components/frontend/README.md
index 114108ad1..50d4f3f1f 100644
--- a/components/frontend/README.md
+++ b/components/frontend/README.md
@@ -97,7 +97,7 @@ In production, put an OAuth/ingress proxy in front of the app to set these heade
 - `GITHUB_APP_SLUG` (required for GitHub integration)
   - The slug of the GitHub App (e.g. `ambient-code`). Without this, the Connect button on the Integrations page is disabled.
 - `GITHUB_CALLBACK_URL` (optional)
-  - Explicit callback URL for GitHub App OAuth. Used when multiple clusters share one GitHub App. Falls back to `<current origin>/integrations/github/setup`. Must be registered as a callback URL in the GitHub App settings.
+  - Explicit callback URL for GitHub App OAuth. Used when multiple clusters share one GitHub App. Falls back to `<current origin>/api/auth/github/user/callback`. Must be registered as a callback URL in the GitHub App settings. Set per-cluster via CI workflow (`oc set env`).
 - Optional dev helpers: `OC_USER`, `OC_EMAIL`, `OC_TOKEN`, `ENABLE_OC_WHOAMI=1`
 
 You can also put these in a `.env.local` file in this folder:
diff --git a/components/frontend/src/components/github-connection-card.tsx b/components/frontend/src/components/github-connection-card.tsx
index 0b4b29a09..f4270365d 100644
--- a/components/frontend/src/components/github-connection-card.tsx
+++ b/components/frontend/src/components/github-connection-card.tsx
@@ -42,7 +42,7 @@ export function GitHubConnectionCard({ appSlug, githubCallbackUrl, showManageBut
 
   const handleConnect = () => {
     if (!appSlug) return
-    const callbackUrl = githubCallbackUrl || `${window.location.origin}/integrations/github/setup`
+    const callbackUrl = githubCallbackUrl || `${window.location.origin}/api/auth/github/user/callback`
     const url = `https://github.com/apps/${appSlug}/installations/new?redirect_uri=${encodeURIComponent(callbackUrl)}`
     window.location.href = url
   }