diff --git a/gateway/src/routes/auth.ts b/gateway/src/routes/auth.ts
index 43e9784..af966f1 100644
--- a/gateway/src/routes/auth.ts
+++ b/gateway/src/routes/auth.ts
@@ -94,22 +94,25 @@ export function createAuthRoutes(
       throw httpError.notFound('app_not_found', `Application '${app_id}' is not registered`);
     }
 
-    // Validate redirect_uri if provided
-    let validatedRedirectUri: string | undefined;
+    // Validate redirect_uri if provided (used for post-auth redirect, not OAuth redirect_uri)
+    let appRedirectUri: string | undefined;
     if (typeof redirect_uri === 'string') {
       if (!isValidRedirectUri(redirect_uri, app.callback_url)) {
         throw httpError.badRequest('invalid_redirect_uri', 'redirect_uri does not match the registered callback URL for this application');
       }
-      validatedRedirectUri = redirect_uri;
+      appRedirectUri = redirect_uri;
     } else if (app.callback_url) {
-      // Use the registered callback URL as default
-      validatedRedirectUri = app.callback_url;
+      appRedirectUri = app.callback_url;
     }
 
+    // Don't pass the app's redirect_uri to the AT Protocol OAuth client --
+    // the PDS must redirect back to ATAuth's own callback, not the downstream app.
+    // The app's redirect_uri is stored in the OAuth state for post-auth redirect.
     const { url, state } = await oauth.generateAuthUrl(
       app_id,
       handle,
-      validatedRedirectUri
+      undefined,
+      appRedirectUri
     );
 
     res.json({
diff --git a/gateway/src/services/oauth.ts b/gateway/src/services/oauth.ts
index c45b141..058a07f 100644
--- a/gateway/src/services/oauth.ts
+++ b/gateway/src/services/oauth.ts
@@ -95,7 +95,7 @@ export class OAuthService {
    * @param handle - The user's AT Protocol handle
    * @param customRedirect - Optional custom redirect URI
    */
-  async generateAuthUrl(appId: string, handle: string, customRedirect?: string): Promise<{
+  async generateAuthUrl(appId: string, handle: string, customRedirect?: string, appRedirectUri?: string): Promise<{
     url: string;
     state: string;
   }> {
@@ -127,7 +127,7 @@ export class OAuthService {
       state,
       code_verifier: '',
       app_id: appId,
-      redirect_uri: customRedirect || this.redirectUri,
+      redirect_uri: appRedirectUri || customRedirect || this.redirectUri,
       created_at: Math.floor(Date.now() / 1000),
     };
     this.db.saveOAuthState(oauthState);