diff --git a/app.py b/app.py
index e15cfbf..e81a745 100644
--- a/app.py
+++ b/app.py
@@ -42,6 +42,12 @@ BTCPAY_TOKEN = os.environ.get("BTCPAY_API_KEY", "")
 PROXY_HOST = os.environ.get("PROXY_PUBLIC_HOST", "10.30.20.116")
 PROXY_PORT = os.environ.get("PROXY_PUBLIC_PORT", "1081")
 
+# BTCPay builds its checkoutLink from the Host header of the API call. The API call
+# must stay on the LAN (Cloudflare bot-blocks urllib's default UA), so the returned
+# link is rewritten to the PUBLIC hostname — otherwise customers get an unreachable
+# https://10.30.20.140/i/... URL.
+BTCPAY_PUBLIC_URL = os.environ.get("BTCPAY_PUBLIC_URL", "https://btcpay.thetempleofdoom.com").rstrip("/")
+
 def db():
     con = getattr(g, "_db", None)
     if con is None:
@@ -200,7 +206,10 @@ def create_btcpay_invoice(user, sats, desc):
         data=body.encode(), headers={"Authorization": f"token {BTCPAY_TOKEN}", "Content-Type": "application/json"}, method="POST")
     r = urllib.request.urlopen(req, timeout=20, context=ctx)
     inv = json.loads(r.read())
-    return inv["id"], inv.get("checkoutLink")
+    link = inv.get("checkoutLink")
+    if link and BTCPAY_PUBLIC_URL and link.startswith(BTCPAY_URL):
+        link = BTCPAY_PUBLIC_URL + link[len(BTCPAY_URL):]
+    return inv["id"], link
 
 @app.route("/api/subscriptions")
 def subscriptions():