diff --git a/backend/internal/service/grok_media.go b/backend/internal/service/grok_media.go
index 585fd5042..a107bd72f 100644
--- a/backend/internal/service/grok_media.go
+++ b/backend/internal/service/grok_media.go
@@ -881,33 +881,5 @@ func grokMediaContentProxyURL(c *gin.Context, requestID string) string {
 	if strings.HasPrefix(c.Request.URL.Path, "/v1/") {
 		pathPrefix = "/v1"
 	}
-	path := pathPrefix + "/videos/" + url.PathEscape(strings.Trim(requestID, "/")) + "/content"
-	host := strings.TrimSpace(c.GetHeader("X-Forwarded-Host"))
-	if comma := strings.IndexByte(host, ','); comma >= 0 {
-		host = strings.TrimSpace(host[:comma])
-	}
-	if host == "" {
-		host = strings.TrimSpace(c.Request.Host)
-	}
-	if strings.ContainsAny(host, " \t\r\n") {
-		return ""
-	}
-	scheme := strings.ToLower(strings.TrimSpace(c.GetHeader("X-Forwarded-Proto")))
-	if comma := strings.IndexByte(scheme, ','); comma >= 0 {
-		scheme = strings.TrimSpace(scheme[:comma])
-	}
-	if scheme != "http" && scheme != "https" {
-		scheme = strings.ToLower(strings.TrimSpace(c.Request.URL.Scheme))
-	}
-	if scheme != "http" && scheme != "https" {
-		if c.Request.TLS != nil {
-			scheme = "https"
-		} else {
-			scheme = "http"
-		}
-	}
-	if host == "" {
-		return path
-	}
-	return scheme + "://" + host + path
+	return pathPrefix + "/videos/" + url.PathEscape(strings.Trim(requestID, "/")) + "/content"
 }
diff --git a/backend/internal/service/grok_media_content_test.go b/backend/internal/service/grok_media_content_test.go
index 9668f35f7..7e52b7e2f 100644
--- a/backend/internal/service/grok_media_content_test.go
+++ b/backend/internal/service/grok_media_content_test.go
@@ -105,7 +105,10 @@ func TestForwardGrokVideoStatusRewritesOnlyProtectedContentURL(t *testing.T) {
 		},
 	}
 	svc := &OpenAIGatewayService{cfg: &config.Config{}, httpUpstream: upstream}
-	c, recorder := grokMediaContentTestContext(http.MethodGet, "https://api.example/v1/videos/task-1", nil)
+	c, recorder := grokMediaContentTestContext(http.MethodGet, "https://api.example/v1/videos/task-1", map[string]string{
+		"X-Forwarded-Host":  "malicious.invalid",
+		"X-Forwarded-Proto": "https",
+	})
 
 	_, err := svc.ForwardGrokMedia(
 		context.Background(), c, grokMediaContentTestAccount(),
@@ -114,8 +117,9 @@ func TestForwardGrokVideoStatusRewritesOnlyProtectedContentURL(t *testing.T) {
 
 	require.NoError(t, err)
 	require.Equal(t, http.StatusOK, recorder.Code)
-	require.Equal(t, "https://api.example/v1/videos/task-1/content", gjson.Get(recorder.Body.String(), "url").String())
-	require.Equal(t, "https://api.example/v1/videos/task-1/content", gjson.Get(recorder.Body.String(), "download_url").String())
+	require.Equal(t, "/v1/videos/task-1/content", gjson.Get(recorder.Body.String(), "url").String())
+	require.Equal(t, "/v1/videos/task-1/content", gjson.Get(recorder.Body.String(), "download_url").String())
 	require.Equal(t, "https://vidgen.x.ai/task-1.mp4", gjson.Get(recorder.Body.String(), "video_url").String())
 	require.Equal(t, "9007199254740993", gjson.Get(recorder.Body.String(), "counter").String())
+	require.NotContains(t, recorder.Body.String(), "malicious.invalid")
 }