diff --git a/package.json b/package.json
index 2ea0d8f..ba4d28d 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "codev-ai",
-  "version": "0.5.17",
+  "version": "0.5.18",
   "description": "CoDev — AI Coding Agent Hub. Install, configure, and manage multiple AI coding agents.",
   "keywords": [
     "ai",
diff --git a/src/lib/const.ts b/src/lib/const.ts
index eb750d6..a68e987 100644
--- a/src/lib/const.ts
+++ b/src/lib/const.ts
@@ -4,7 +4,13 @@ import { join } from "node:path";
 import pkg from "../../package.json" with { type: "json" };
 
 const BASE_URL = atob("aHR0cHM6Ly9uZXRtaW5kLnZpZXR0ZWwudm4=");
-export const BACKEND_URL = `${BASE_URL}/codev-backend`;
+// `CODEV_BACKEND_URL` points the hub at a codev-backend running somewhere
+// else — `bun dev` in that repo serves http://127.0.0.1:8787. Unset in every
+// real install, so the baked URL is what ships. SSO is deliberately NOT
+// overridable: a local backend still verifies tokens against the real
+// provider, so the login flow has to mint a real one.
+export const BACKEND_URL =
+	process.env.CODEV_BACKEND_URL || `${BASE_URL}/codev-backend`;
 export const SSO_URL = `${BASE_URL}/sso-wrapper`;
 export const LOGIN_SUCCESS_URL = `${BASE_URL}/codev/oauth/success`;
 export const SKILLHUB_URL = `${BASE_URL}/netmindhub`;