diff --git a/plugins/tools/frontend/views/SecureSendCreate.vue b/plugins/tools/frontend/views/SecureSendCreate.vue
index dd308d72..5c2621a8 100644
--- a/plugins/tools/frontend/views/SecureSendCreate.vue
+++ b/plugins/tools/frontend/views/SecureSendCreate.vue
@@ -91,6 +91,8 @@
 <script setup>
 import { ref, computed } from 'vue'
 import { toolsApi } from '../api'
+import { withBase } from '@/utils/basePath'
+import { getSiteBaseUrl } from '@/utils/siteSettings'
 import {
   sealSecret, refuseReason, pasteCarriesFiles, cryptoAvailable, MAX_PLAINTEXT,
 } from '../securesend'
@@ -137,9 +139,24 @@ async function createLink() {
       views: views.value,
     })
     const token = response.data.data.token
+
+    // THE SITE'S CONFIGURED URL, not the one this browser happens to be using.
+    // site_base_url exists for exactly this - "used for QR codes and any
+    // absolute link the app emits" - because somebody creating a secret may
+    // have reached the app by an IP, a short hostname, or a name that only
+    // resolves inside one VLAN, and the recipient has to open the link from
+    // wherever they are. It falls back to the browsing origin when a site has
+    // not set one.
+    //
+    // withBase for the path: a site served under /shopdb or /ops carries that
+    // in front of every route, and leaving it off produced a 404 from IIS for a
+    // secret that existed - with the sender shown a link that could never work.
+    const origin = (await getSiteBaseUrl()).replace(/\/+$/, '')
+    const path = withBase(`/s/${token}`)
+
     // The key rides in the FRAGMENT. Browsers never send it, so it reaches the
     // recipient and nowhere else.
-    link.value = `${window.location.origin}/s/${token}#${sealed.fragmentKey}`
+    link.value = `${origin}${path}#${sealed.fragmentKey}`
     // Drop the plaintext as soon as it is sealed: no reason to keep it in memory
     // behind the link that replaced it.
     plaintext.value = ''