diff --git a/app/handlers/analytics_callback_event_handler.rb b/app/handlers/analytics_callback_event_handler.rb
index 66b903be..c4e7848d 100644
--- a/app/handlers/analytics_callback_event_handler.rb
+++ b/app/handlers/analytics_callback_event_handler.rb
@@ -11,7 +11,9 @@ def initialize(params, meeting_id, tenant = nil)
   def handle
     return if analytics_callback_url.nil?
 
-    host_name = Rails.configuration.x.url_host
+    # Use ANALYTICS_CALLBACK_URL_HOST if set (for HA/proxy deployments)
+    # Otherwise fall back to URL_HOST (for direct deployments)
+    host_name = Rails.configuration.x.analytics_callback_url_host || Rails.configuration.x.url_host
 
     params['meta_analytics-callback-url'] = if tenant.present?
       "https://#{tenant.name}.#{host_name}/bigbluebutton/api/analytics_callback"
diff --git a/config/application.rb b/config/application.rb
index b87feddd..de835ae3 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -115,6 +115,10 @@ class Application < Rails::Application
     # Scalelite Host name
     config.x.url_host = ENV.fetch('URL_HOST', nil)
 
+    # Analytics callback URL host (for HA deployments behind proxy)
+    # Falls back to URL_HOST if not set. Use for deployments where URL_HOST is internal.
+    config.x.analytics_callback_url_host = ENV.fetch('ANALYTICS_CALLBACK_URL_HOST', nil)
+
     # DB connection retry attempt counts
     config.x.db_connection_retry_count = ENV.fetch('DB_CONNECTION_RETRY_COUNT', '3').to_i
 
diff --git a/docs/configuration-README.md b/docs/configuration-README.md
index 22ec036a..388df800 100644
--- a/docs/configuration-README.md
+++ b/docs/configuration-README.md
@@ -75,6 +75,7 @@ These variables are used by the service startup scripts in the Docker images, bu
 * `USE_EXTERNAL_VOICE_BRIDGE`: Whether or not to try to use the `voiceBridge` number passed by the BigBlueButton API client. Defaults to `false`. If your API client generates numbers compatible with your BigBlueButton configuration, you can change this to `true` to use them. Note that Scalelite will ignore the voice bridge number provided, and generate a new one, if the number is already in use by a different meeting.
 * `FSAPI_PASSWORD`: Password (for "Basic" authentication) to access the freeswitch dialplan API. Default is to use the first `LOADBALANCER_SECRET` as the password. You can set this to the empty string to disable authentication.
 * `FSAPI_MAX_DURATION`: Maximum duration for voice calls handled by the freeswitch dialplan integration in minutes. Defaults to `MAX_MEETING_DURATION` if that is set, otherwise no limit. You probably want to set a limit here to ensure you do not have excess expenses due to people not hanging up calls.
+* `ANALYTICS_CALLBACK_URL_HOST`: The hostname used to construct the analytics callback URL sent to BigBlueButton servers. This is useful for High Availability deployments where `URL_HOST` is set to an internal hostname for DNS rebinding protection, but the analytics callbacks need to reach a public-facing hostname. If not set, falls back to `URL_HOST`. Example: In HA deployments set `URL_HOST=scalelite-api` (internal) and `ANALYTICS_CALLBACK_URL_HOST=sl.example.com` (public). Defaults to the value of `URL_HOST` if not specified.
 
 ### Configure your Front-End to use Scalelite