diff --git a/ops/nixos/bvm-paperless/default.nix b/ops/nixos/bvm-paperless/default.nix
index 5203004e7a..a32623c463 100644
--- a/ops/nixos/bvm-paperless/default.nix
+++ b/ops/nixos/bvm-paperless/default.nix
@@ -25,8 +25,10 @@ in {
     enable = true;
     address = config.my.ip.tailscale;
     extraConfig = {
+      PAPERLESS_URL = "https://paperless.int.lukegb.com";
       PAPERLESS_ALLOWED_HOSTS = "paperless.int.lukegb.com,bvm-paperless.int.as205479.net:28981,bvm-paperless.int.as205479.net";
       PAPERLESS_CORS_ALLOWED_HOSTS = "https://paperless.int.lukegb.com,http://bvm-paperless.int.as205479.net:28981";
+      PAPERLESS_CSRF_TRUSTED_ORIGINS = "https://paperless.int.lukegb.com,http://bvm-paperless.int.as205479.net:28981";
       PAPERLESS_ENABLE_HTTP_REMOTE_USER = "true";
       PAPERLESS_DBHOST = "/run/postgresql";
       PAPERLESS_DBPASS = "";