diff --git a/CHANGELOG.md b/CHANGELOG.md
index e44c80a..fc4b053 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Default Core API and Tatlock API URLs now use the public domains
+  `https://api.schweitz.net` and `https://tatlock.schweitz.net` (previously LAN
+  `http://192.168.86.149:8083`/`:8000`), so default builds require OIDC auth;
+  override via `--dart-define` for direct LAN development
+
 ## [1.6.0] - 2026-01-08
 
 ### Added
diff --git a/lib/core/config/app_config.dart b/lib/core/config/app_config.dart
index 901967c..71c8761 100644
--- a/lib/core/config/app_config.dart
+++ b/lib/core/config/app_config.dart
@@ -1,35 +1,37 @@
 /// Application configuration from compile-time environment variables.
 ///
-/// ## Development (LAN - no auth required)
-/// Default values use LAN IPs for local development:
+/// ## Defaults (public URLs - auth required)
+/// Default values use the public https://*.schweitz.net domains so browser
+/// clients work from any machine (NPM fronts them; LAN clients bypass
+/// Authentik via source-IP rules):
 /// ```bash
 /// flutter run -d chrome
 /// ```
 ///
-/// ## Production (public URLs - auth required)
-/// Override with public URLs for production builds:
+/// ## Development (LAN - no auth required)
+/// Override with LAN URLs to hit services directly without OIDC:
 /// ```bash
-/// flutter build web \
-///   --dart-define=CORE_API_URL=https://api.schweitz.net \
-///   --dart-define=TATLOCK_API_URL=https://tatlock.schweitz.net
+/// flutter run -d chrome \
+///   --dart-define=CORE_API_URL=http://192.168.86.149:8083 \
+///   --dart-define=TATLOCK_API_URL=http://192.168.86.149:8000
 /// ```
 class AppConfig {
   AppConfig._();
 
   /// Core API base URL
-  /// - LAN default: No auth required
-  /// - Production: https://api.schweitz.net (requires OIDC)
+  /// - Default: https://api.schweitz.net (requires OIDC)
+  /// - LAN override: http://192.168.86.149:8083 (no auth)
   static const coreApiUrl = String.fromEnvironment(
     'CORE_API_URL',
-    defaultValue: 'http://192.168.86.149:8083',
+    defaultValue: 'https://api.schweitz.net',
   );
 
   /// Tatlock API base URL
-  /// - LAN default: No auth required
-  /// - Production: https://tatlock.schweitz.net (requires OIDC)
+  /// - Default: https://tatlock.schweitz.net (requires OIDC)
+  /// - LAN override: http://192.168.86.149:8000 (no auth)
   static const tatlockApiUrl = String.fromEnvironment(
     'TATLOCK_API_URL',
-    defaultValue: 'http://192.168.86.149:8000',
+    defaultValue: 'https://tatlock.schweitz.net',
   );
 
   /// Authentik OIDC discovery URL
diff --git a/test/core/config/app_config_test.dart b/test/core/config/app_config_test.dart
new file mode 100644
index 0000000..c159484
--- /dev/null
+++ b/test/core/config/app_config_test.dart
@@ -0,0 +1,15 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:tatlock_ui/core/config/app_config.dart';
+
+void main() {
+  group('AppConfig', () {
+    test('defaults to public schweitz.net API URLs', () {
+      expect(AppConfig.coreApiUrl, 'https://api.schweitz.net');
+      expect(AppConfig.tatlockApiUrl, 'https://tatlock.schweitz.net');
+    });
+
+    test('requiresAuth is true with default schweitz.net URLs', () {
+      expect(AppConfig.requiresAuth, isTrue);
+    });
+  });
+}