diff --git a/.builds/publish.yml b/.builds/publish.yml
index 5112df8dc45778d2be4bd668a1a40d9f3e681542..74fb5a36e84e0d59a1880e0389689077ef9516b9 100644
--- a/.builds/publish.yml
+++ b/.builds/publish.yml
@@ -102,6 +102,11 @@
       cd /home/build/pages
       tar -czvf /home/build/site.tar.gz .
   - publish_pages: |
+      # The srht.bigb.es OAuth worker writes the per-service origin
+      # `http://pages:5112` (internal docker-compose hostname) into
+      # ~/.config/hut/config. Override with the public origin before
+      # hut runs, or it can't reach the API from outside the cluster.
+      sed -i 's|http://pages:5112|https://pages.srht.bigb.es|' ~/.config/hut/config
       hut pages publish -d "$PAGES_DOMAIN" -s "$PAGES_SUBPATH" /home/build/site.tar.gz
   - stage_artifacts: |
       # `artifacts:` paths resolve relative to /home/build. Copy the four