diff --git a/cmd/soundtouch-service/main.go b/cmd/soundtouch-service/main.go
index 79209f1..6892f88 100644
--- a/cmd/soundtouch-service/main.go
+++ b/cmd/soundtouch-service/main.go
@@ -964,10 +964,17 @@ func applyPersistedSettings(ds *datastore.DataStore, config *serviceConfig) data
 	}
 
 	// persisted.HTTPServerURL is the HTTPS override (empty = derive).
-	// Existing installs carry their old effective value here, so it is
-	// preserved as an override; recompute the effective URL either way,
-	// since serverURL may have come from the persisted settings above.
+	// Existing installs carry their old effective value here; if it is
+	// exactly what we would derive anyway, treat it as "derive" so those
+	// installs don't show a spurious override in the UI. A genuinely custom
+	// value is kept as an override. Recompute either way, since serverURL
+	// may have come from the persisted settings above.
 	config.httpsOverride = persisted.HTTPServerURL
+	if config.httpsOverride != "" &&
+		config.httpsOverride == handlers.DeriveHTTPSURL(config.serverURL, "", config.httpsPort, config.httpsDefaultURL) {
+		config.httpsOverride = ""
+	}
+
 	config.httpsServerURL = handlers.DeriveHTTPSURL(config.serverURL, config.httpsOverride, config.httpsPort, config.httpsDefaultURL)
 
 	config.discoveryEnabled = persisted.DiscoveryEnabled
diff --git a/pkg/service/handlers/web/index.html b/pkg/service/handlers/web/index.html
index 9a5f7c5..8d84e4c 100644
--- a/pkg/service/handlers/web/index.html
+++ b/pkg/service/handlers/web/index.html
@@ -187,21 +187,20 @@
             <label>HTTPS URL:</label>
             <code id="https-url-effective">—</code>
             <span id="https-url-effective-note" style="font-size: 0.8em; color: #666"></span>
-            <div style="margin-top: 6px">
-                <span class="info-toggle" onclick="toggleInfo('https-url-override-info')">Advanced: override HTTPS URL ⓘ</span>
-                <div id="https-url-override-info" class="info-details">
-                    <p style="font-size: 0.85em; color: #666; margin: 4px 0">
-                        AfterTouch also serves an HTTPS endpoint (used for the
-                        DNS-based redirect, music-service login, and certificate
-                        trust). By default it follows the Target Domain above
-                        (same host, on the HTTPS port), so you normally don't
-                        set anything here. Provide an override only when a
-                        reverse proxy serves HTTPS on a different host or port.
-                        Leave it empty to go back to deriving it automatically.
-                        Takes effect after saving.
-                    </p>
-                    <input type="text" id="https-url-override" placeholder="https://host:8443 (empty = derive)" style="width: 300px"/>
-                </div>
+            <span class="info-toggle" onclick="toggleInfo('https-url-override-info')">ⓘ</span>
+            <div id="https-url-override-info" class="info-details">
+                <p style="margin: 0 0 8px 0">
+                    AfterTouch also serves an HTTPS endpoint (used for the
+                    DNS-based redirect, music-service login, and certificate
+                    trust). By default it follows the Target Domain above
+                    (same host, on the HTTPS port), so you normally don't set
+                    anything here. Provide an override only when a reverse
+                    proxy serves HTTPS on a different host or port. Leave it
+                    empty to go back to deriving it automatically. Takes effect
+                    after saving.
+                </p>
+                <label for="https-url-override">Override:</label>
+                <input type="text" id="https-url-override" placeholder="https://host:8443 (empty = derive)" style="width: 300px"/>
             </div>
         </div>
         <div style="margin-bottom: 20px">