diff --git a/deploy/helm/go-guess/templates/web-deployment.yaml b/deploy/helm/go-guess/templates/web-deployment.yaml
index 552078f..84cfd2e 100644
--- a/deploy/helm/go-guess/templates/web-deployment.yaml
+++ b/deploy/helm/go-guess/templates/web-deployment.yaml
@@ -39,6 +39,14 @@ spec:
           imagePullPolicy: {{ .Values.web.image.pullPolicy }}
           securityContext:
             {{- toYaml .Values.web.securityContext | nindent 12 }}
+          env:
+            {{- with .Values.web.themeBaseUrl }}
+            # Read by the browser, not the API, so it goes to the web container:
+            # the entrypoint writes it into runtime-config.js on start. Empty keeps
+            # the application on its own styling.
+            - name: THEME_BASE_URL
+              value: {{ . | quote }}
+            {{- end }}
           ports:
             - name: http
               containerPort: 80
diff --git a/deploy/helm/go-guess/values.yaml b/deploy/helm/go-guess/values.yaml
index fdee21d..c16a699 100644
--- a/deploy/helm/go-guess/values.yaml
+++ b/deploy/helm/go-guess/values.yaml
@@ -78,8 +78,13 @@ web:
   replicaCount: 2
   image:
     repository: batty1039.startdedicated.net:5000/go-guess-web
-    tag: "0.0.1"
+    tag: "0.1.0"
     pullPolicy: IfNotPresent
+  # Origin of the go-bananas runtime supplying the shared styling contract, for
+  # example https://bananas-dev.urpi.be. Empty keeps this application's own
+  # styles. The theme service must also allow this application's origin, or the
+  # browser refuses to load the controls from it.
+  themeBaseUrl: ""
   service:
     type: ClusterIP
     port: 80
diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index 16970b8..63a8c4e 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -8,5 +8,11 @@ RUN npm run build
 FROM nginx:1.29-alpine
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=build /app/dist /usr/share/nginx/html
+# Writes runtime-config.js from the environment on start, so one image serves
+# every environment instead of baking a hostname into the bundle at build time.
+# It lives beside this Dockerfile because the build context is ./frontend.
+COPY entrypoint.sh /usr/local/bin/go-guess-frontend-entrypoint
+RUN chmod +x /usr/local/bin/go-guess-frontend-entrypoint
 EXPOSE 80
+ENTRYPOINT ["/usr/local/bin/go-guess-frontend-entrypoint"]
 CMD ["nginx", "-g", "daemon off;"]
diff --git a/frontend/entrypoint.sh b/frontend/entrypoint.sh
new file mode 100755
index 0000000..654d280
--- /dev/null
+++ b/frontend/entrypoint.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+# Writes the runtime configuration the page reads before the bundle runs, then
+# hands over to nginx.
+#
+# The front end is built once and served by many environments, so anything that
+# differs between them has to be resolved here rather than baked into the bundle.
+# Right now that is the origin of the theme service; an empty value leaves the
+# application on its own styling.
+set -eu
+
+CONFIG_DIR=/usr/share/nginx/html
+CONFIG_FILE="$CONFIG_DIR/runtime-config.js"
+
+# nginx serves its own error pages from this directory, so a read-only filesystem
+# would otherwise turn a missing file into a 500. The default is already in the
+# image, so this only replaces it.
+cat > "$CONFIG_FILE" <<CONFIG
+window.__GO_GUESS_CONFIG__ = { themeBaseUrl: "${THEME_BASE_URL:-}" }
+CONFIG
+
+exec "$@"