diff --git a/module/VuFind/src/VuFind/Bootstrapper.php b/module/VuFind/src/VuFind/Bootstrapper.php
index 4c49e8476f5..8197114ef48 100644
--- a/module/VuFind/src/VuFind/Bootstrapper.php
+++ b/module/VuFind/src/VuFind/Bootstrapper.php
@@ -403,7 +403,7 @@ protected function initRateLimiter(): void
                     ]));
                     $response->getHeaders()->addHeaderLine(
                         'Location',
-                        '/vufind/Turnstile/Challenge?context=' . $context
+                        $event->getRequest()->getBaseUrl() . '/Turnstile/Challenge?context=' . $context
                     );
                 } else {
                     $response->setStatusCode(429);
diff --git a/themes/bootstrap5/templates/turnstile/challenge.phtml b/themes/bootstrap5/templates/turnstile/challenge.phtml
index ff76b3180d2..19f60995719 100644
--- a/themes/bootstrap5/templates/turnstile/challenge.phtml
+++ b/themes/bootstrap5/templates/turnstile/challenge.phtml
@@ -15,7 +15,7 @@
     data-callback="turnstileChallengeEnded"
     data-error-callback="turnstileChallengeEnded"
 ></div>
-<form id="turnstile_form" method="post" action="/vufind/Turnstile/Verify">
+<form id="turnstile_form" method="post" action="<?=$this->url('turnstile-verify')?>">
     <input id="turnstile_token" name="token" type="hidden">
     <input name="policyId" type="hidden" value="<?=$this->escapeHtml($policyId)?>">
     <input name="destination" type="hidden" value="<?=$this->escapeHtml($destination)?>">