diff --git a/.env.example b/.env.example
index b74b637..8435a8a 100644
--- a/.env.example
+++ b/.env.example
@@ -1,8 +1,10 @@
-CIE_AUTH_ALLOWED_HOSTS=cie-auth.example.it,auth.example.it
-DJANGO_TRUST_ANCHOR=https://federation-authority.example.it
-DJANGO_PROVIDER_ISSUER=https://provider.example.it/oidc/op
-DJANGO_RP_BACKEND_EXCHANGE_URL=https://visione-backend.example.it/api/v1/auth/cie/exchange
-DJANGO_RP_SHARED_SECRET=change-me
-FEDERATION_AUTHORITY_SECRET_KEY=change-me
-PROVIDER_SECRET_KEY=change-me
-RELYING_PARTY_SECRET_KEY=change-me
+CIE_AUTH_ALLOWED_HOSTS=fa-cie.visionebari.it,provider-cie.visionebari.it,rp-cie.visionebari.it
+DJANGO_TRUST_ANCHOR=https://fa-cie.visionebari.it
+DJANGO_PROVIDER_ISSUER=https://provider-cie.visionebari.it/oidc/op
+DJANGO_RP_DEFAULT_PROVIDER=https://provider-cie.visionebari.it/oidc/op
+DJANGO_RP_BASE_URL=https://rp-cie.visionebari.it
+DJANGO_RP_BACKEND_EXCHANGE_URL=https://api.visionebari.it/api/v1/auth/cie/exchange
+DJANGO_RP_SHARED_SECRET=change_me_with_a_secure_random_string
+FEDERATION_AUTHORITY_SECRET_KEY=change_me_with_a_secure_random_string
+PROVIDER_SECRET_KEY=change_me_with_a_secure_random_string
+RELYING_PARTY_SECRET_KEY=change_me_with_a_secure_random_string
diff --git a/Dockerfile b/Dockerfile
index 3da08f4..35ee8af 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,6 +15,7 @@ RUN pip install --no-cache-dir --upgrade pip \
 WORKDIR /app
 
 COPY entrypoint.sh /entrypoint.sh
+COPY scripts /app/scripts
 RUN chmod +x /entrypoint.sh
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/docker-compose.yml b/docker-compose.yml
index 64093e3..01dca17 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -52,6 +52,7 @@ services:
       DJANGO_RP_BACKEND_EXCHANGE_URL: ${DJANGO_RP_BACKEND_EXCHANGE_URL:-http://visione-backend:5555/api/v1/auth/cie/exchange}
       DJANGO_RP_SHARED_SECRET: ${DJANGO_RP_SHARED_SECRET:-change-me-for-local-dev}
       DJANGO_RP_DEFAULT_PROVIDER: ${DJANGO_RP_DEFAULT_PROVIDER:-http://provider:8002/oidc/op}
+      DJANGO_RP_BASE_URL: ${DJANGO_RP_BASE_URL:-http://relying-party:8001}
       LOAD_FIXTURE_ON_EMPTY_DB: ${RELYING_PARTY_LOAD_FIXTURE_ON_EMPTY_DB:-true}
     expose:
       - "8001"
diff --git a/entrypoint.sh b/entrypoint.sh
index c68fde2..4e0ceac 100644
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -9,8 +9,11 @@ cd "$APP_DIR"
 mkdir -p logs static
 
 if [ ! -f "$APP_DIR/db.sqlite3" ] && [ "${LOAD_FIXTURE_ON_EMPTY_DB:-true}" = "true" ]; then
+  TMP_DUMP="$(mktemp)"
+  python /app/scripts/rewrite_dumps.py dumps/example.json "$TMP_DUMP"
   python manage.py migrate
-  python manage.py loaddata dumps/example.json
+  python manage.py loaddata "$TMP_DUMP"
+  rm -f "$TMP_DUMP"
 else
   python manage.py migrate
 fi
@@ -19,4 +22,9 @@ fi
 # Collect them into STATIC_ROOT so the explicit /static/ URL can serve them.
 python manage.py collectstatic --noinput
 
+if grep -aEq '127\.0\.0\.1|provider:8002' "$APP_DIR/db.sqlite3"; then
+  echo "Refusing to start: bootstrap data still contains internal/local URLs" >&2
+  exit 1
+fi
+
 exec python manage.py runserver 0.0.0.0:"$PORT"
diff --git a/scripts/rewrite_dumps.py b/scripts/rewrite_dumps.py
new file mode 100644
index 0000000..97c509a
--- /dev/null
+++ b/scripts/rewrite_dumps.py
@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+import json
+import os
+import pathlib
+import sys
+
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+
+
+def env(name: str, default: str = "") -> str:
+    value = os.getenv(name, default).strip()
+    if not value:
+        raise SystemExit(f"missing env: {name}")
+    return value.rstrip("/")
+
+
+TA = env("DJANGO_TRUST_ANCHOR")
+PROVIDER_ISSUER = env("DJANGO_PROVIDER_ISSUER")
+RP_BASE = env("DJANGO_RP_BASE_URL")
+RP_ISSUER = f"{RP_BASE}/oidc/rp"
+PROVIDER_BASE = PROVIDER_ISSUER.removesuffix("/oidc/op")
+
+
+def deep_replace(value):
+    if isinstance(value, dict):
+        return {k: deep_replace(v) for k, v in value.items()}
+    if isinstance(value, list):
+        return [deep_replace(v) for v in value]
+    if isinstance(value, str):
+        return (
+            value.replace("http://127.0.0.1:8000/oidc/op", TA + "/oidc/op")
+            .replace("http://127.0.0.1:8001/oidc/rp", RP_ISSUER)
+            .replace("http://127.0.0.1:8002/oidc/op", PROVIDER_ISSUER)
+            .replace("http://127.0.0.1:8000", TA)
+            .replace("http://127.0.0.1:8001", RP_BASE)
+            .replace("http://127.0.0.1:8002", PROVIDER_BASE)
+            .replace("http://provider:8002/oidc/op", PROVIDER_ISSUER)
+            .replace("http://provider:8002", PROVIDER_BASE)
+        )
+    return value
+
+
+if len(sys.argv) != 3:
+    raise SystemExit("usage: rewrite_dumps.py <input_dump> <output_dump>")
+
+src = pathlib.Path(sys.argv[1])
+dst = pathlib.Path(sys.argv[2])
+data = json.loads(src.read_text())
+dst.write_text(json.dumps(deep_replace(data), indent=2, ensure_ascii=False) + "\n")