diff --git a/apps/api/src/routes/setup.ts b/apps/api/src/routes/setup.ts
index 13795e5..5d5ec8f 100644
--- a/apps/api/src/routes/setup.ts
+++ b/apps/api/src/routes/setup.ts
@@ -63,7 +63,11 @@ const configSchema = z.object({
     .refine((v) => v.startsWith('https://'), { message: 'oidcIssuer must be an https URL' }),
   oidcClientId: z.string().min(1).max(256),
   vapidPublicKey: z.string().min(1).max(512),
-  appExternalUrl: z.string().url().max(512),
+  appExternalUrl: z
+    .string()
+    .url()
+    .max(512)
+    .refine((v) => v.startsWith('https://'), { message: 'appExternalUrl must be an https URL' }),
 });
 
 const credentialSchema = z.object({