diff --git a/app.yaml b/app.yaml
index 8e5ab9b..4fedb28 100644
--- a/app.yaml
+++ b/app.yaml
@@ -26,6 +26,7 @@ auth:
   env:
     COGNITO_CLIENT_ID: NUXT_PUBLIC_OIDC_CLIENT_ID
     COGNITO_ISSUER_URL: NUXT_PUBLIC_OIDC_AUTHORITY
+    COGNITO_DOMAIN: NUXT_PUBLIC_OIDC_LOGOUT_DOMAIN
 
 environment:
   CUPCAKE_BACKEND: https://cupcake-backend.javazone.no
diff --git a/app/composables/useAuth.ts b/app/composables/useAuth.ts
index 91bc639..99998de 100644
--- a/app/composables/useAuth.ts
+++ b/app/composables/useAuth.ts
@@ -76,7 +76,15 @@ export async function completeLoginCallback(): Promise<string> {
 export async function logout(): Promise<void> {
   currentUser = null
   await getUserManager().removeUser()
-  await getUserManager().signoutRedirect()
+
+  // Cognito's /logout ignores post_logout_redirect_uri; it needs client_id and
+  // a logout_uri that exactly matches one of the client's logout URLs.
+  const { oidcClientId, oidcLogoutDomain } = useRuntimeConfig().public
+  const params = new URLSearchParams({
+    client_id: oidcClientId,
+    logout_uri: `${window.location.origin}/`,
+  })
+  window.location.assign(`https://${oidcLogoutDomain}/logout?${params}`)
 }
 
 let tokenEndpointPromise: Promise<string> | null = null
diff --git a/nuxt.config.ts b/nuxt.config.ts
index 88aa7eb..a4c320d 100644
--- a/nuxt.config.ts
+++ b/nuxt.config.ts
@@ -16,6 +16,7 @@ export default defineNuxtConfig({
       oidcAuthority:
         "https://cognito-idp.eu-central-1.amazonaws.com/eu-central-1_Icikv3dtD",
       oidcClientId: "",
+      oidcLogoutDomain: "javabin-internal.auth.eu-central-1.amazoncognito.com",
     },
   },
 
diff --git a/terraform/main.tf b/terraform/main.tf
index c97d05b..4d50f84 100644
--- a/terraform/main.tf
+++ b/terraform/main.tf
@@ -76,13 +76,14 @@ module "service" {
   readonly_root_filesystem = true
   target_group_arn         = module.routing.target_group_arn
   environment = {
-    CUPCAKE_BACKEND            = "https://cupcake-backend.javazone.no"
-    COGNITO_USER_POOL_ID       = module.auth.user_pool_id
-    COGNITO_DOMAIN             = module.auth.user_pool_domain
-    COGNITO_ISSUER_URL         = module.auth.issuer_url
-    COGNITO_WELL_KNOWN_URL     = module.auth.well_known_url
-    COGNITO_GROUPS             = "helter"
-    NUXT_PUBLIC_OIDC_AUTHORITY = module.auth.issuer_url
+    CUPCAKE_BACKEND                = "https://cupcake-backend.javazone.no"
+    COGNITO_USER_POOL_ID           = module.auth.user_pool_id
+    COGNITO_DOMAIN                 = module.auth.user_pool_domain
+    COGNITO_ISSUER_URL             = module.auth.issuer_url
+    COGNITO_WELL_KNOWN_URL         = module.auth.well_known_url
+    COGNITO_GROUPS                 = "helter"
+    NUXT_PUBLIC_OIDC_AUTHORITY     = module.auth.issuer_url
+    NUXT_PUBLIC_OIDC_LOGOUT_DOMAIN = module.auth.user_pool_domain
   }
   secrets = {
     COGNITO_CLIENT_ID          = module.auth.client_id_arn