diff --git a/public/docs.html b/public/docs.html
index 14fd124..8e00b00 100644
--- a/public/docs.html
+++ b/public/docs.html
@@ -293,7 +293,11 @@
 
 <script src="/particles.js"></script>
 <script>
-  const origin = location.origin;
+  // Substituted by the server with this hub's public address. These commands run
+  // on a different machine, so location.origin would be wrong whenever the reader
+  // reached this page by IP or over a tunnel. Falls back only if served unmodified.
+  const stamped = '__HUB__';
+  const origin = stamped.indexOf('__') === 0 ? location.origin : stamped;
 
   const commands = {
     'cmd-macos':          `curl -fsSL ${origin}/install.sh?token=TOKEN | sh`,
diff --git a/public/enroll.html b/public/enroll.html
index 956d3c4..ed3868b 100644
--- a/public/enroll.html
+++ b/public/enroll.html
@@ -119,8 +119,12 @@
 
 <script>
   const token = location.pathname.split('/').filter(Boolean).pop();
-  const origin = location.origin;
-  const link = `${origin}/enroll/${token}`;
+
+  // Substituted by the server with this hub's public address — the commands below
+  // are pasted into a terminal on this machine and have to reach the hub by a name
+  // it can resolve, not by whatever host the reader used to open this page.
+  const stamped = '__HUB__';
+  const origin = stamped.indexOf('__') === 0 ? location.origin : stamped;
 
   // The hub stamps its own address and this token into the install scripts, so
   // each of these really is the whole command — nothing to fill in by hand.
diff --git a/server/index.js b/server/index.js
index 19757e5..0d06d23 100644
--- a/server/index.js
+++ b/server/index.js
@@ -120,9 +120,25 @@ app.get('/install.ps1', serveInstallScript('install.ps1', 'text/plain; charset=u
 app.use('/novnc', express.static(NOVNC_DIR, { maxAge: '7d', immutable: true }));
 app.use(express.static(PUBLIC_DIR));
 
+// The setup pages print commands that get run on *another* machine, so they must
+// name this hub's public address — not whatever host the reader happens to have
+// typed. Reached over the LAN IP, `location.origin` would hand out a URL the
+// target machine may not be able to resolve at all.
+function sendPageWithHub(file) {
+  return (req, res) => {
+    let html;
+    try {
+      html = fs.readFileSync(path.join(PUBLIC_DIR, file), 'utf8');
+    } catch {
+      return res.status(500).type('text/plain').send(`${file} missing from this deployment`);
+    }
+    res.type('html').send(html.split('__HUB__').join(config.baseUrl(req)));
+  };
+}
+
 app.get('/viewer', (_req, res) => res.sendFile(path.join(PUBLIC_DIR, 'viewer.html')));
-app.get('/docs', (_req, res) => res.sendFile(path.join(PUBLIC_DIR, 'docs.html')));
-app.get('/enroll/:token', (_req, res) => res.sendFile(path.join(PUBLIC_DIR, 'enroll.html')));
+app.get('/docs', sendPageWithHub('docs.html'));
+app.get('/enroll/:token', sendPageWithHub('enroll.html'));
 app.get('/s/:token', (_req, res) => res.sendFile(path.join(PUBLIC_DIR, 'share.html')));
 
 app.use((req, res) => {