diff --git a/web/src/pages/providers/proxy/ProxyProviderViewPage.ts b/web/src/pages/providers/proxy/ProxyProviderViewPage.ts
index 275dcc579..59ee4c4e5 100644
--- a/web/src/pages/providers/proxy/ProxyProviderViewPage.ts
+++ b/web/src/pages/providers/proxy/ProxyProviderViewPage.ts
@@ -48,6 +48,16 @@ export function ModeToLabel(action?: ProxyMode): string {
     }
 }
 
+export function isForward(mode: ProxyMode): boolean {
+    switch (mode) {
+        case ProxyMode.Proxy:
+            return false;
+        case ProxyMode.ForwardSingle:
+        case ProxyMode.ForwardDomain:
+            return true;
+    }
+}
+
 @customElement("ak-provider-proxy-view")
 export class ProxyProviderViewPage extends LitElement {
     @property()
@@ -246,9 +256,7 @@ export class ProxyProviderViewPage extends LitElement {
                 <div class="pf-c-card pf-l-grid__item pf-m-12-col">
                     <div class="pf-c-card__title">${t`Setup`}</div>
                     <div class="pf-c-card__body">
-                        ${[ProxyMode.ForwardSingle, ProxyMode.ForwardDomain].includes(
-                            this.provider?.mode || ProxyMode.Proxy,
-                        )
+                        ${isForward(this.provider?.mode || ProxyMode.Proxy)
                             ? html`
                                   <ak-tabs pageIdentifier="proxy-setup">
                                       <section
diff --git a/website/docs/providers/proxy/_nginx_ingress.md b/website/docs/providers/proxy/_nginx_ingress.md
index 4da3c30b1..3524a94b3 100644
--- a/website/docs/providers/proxy/_nginx_ingress.md
+++ b/website/docs/providers/proxy/_nginx_ingress.md
@@ -25,8 +25,10 @@ Add these annotations to the ingress you want to protect
 ```yaml
 metadata:
     annotations:
+        # This should be the in-cluster DNS name for the authentik outpost service
+        # as when the external URL is specified here, nginx will overwrite some crucial headers
         nginx.ingress.kubernetes.io/auth-url: |-
-            http://outpost.company:9000/outpost.goauthentik.io/auth/nginx
+            http://ak-outpost-example.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx
         # If you're using domain-level auth, use the authentication URL instead of the application URL
         nginx.ingress.kubernetes.io/auth-signin: |-
             https://app.company/outpost.goauthentik.io/start?rd=$escaped_request_uri