diff --git a/installer/install.sh b/installer/install.sh
index c2b6efb..155ee44 100644
--- a/installer/install.sh
+++ b/installer/install.sh
@@ -494,6 +494,9 @@ merge_config() {
   : "${COMPOSE_PROJECT:=$DEFAULT_COMPOSE_PROJECT}"
   : "${DOCKER_SOCKET:=$DEFAULT_DOCKER_SOCKET}"
 
+  # Force lowercase hostname — Logto normalizes internally, case mismatch breaks JWT validation
+  PUBLIC_HOST=$(echo "$PUBLIC_HOST" | tr '[:upper:]' '[:lower:]')
+
   if [ -z "$NODE_TLS_REJECT" ]; then
     if [ "$TLS_MODE" = "custom" ]; then
       NODE_TLS_REJECT="1"