diff --git a/CLAUDE.md b/CLAUDE.md
index 15d3b64..87597a5 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -7,7 +7,7 @@ Replaces WhatsApp/Excel safety reporting. Client: Ms. Agnes, Mr. Terence, Mr. Ya
 ## Stack
 - **Frontend + API routes:** Next.js (App Router)
 - **DB + Auth + Storage:** Supabase (Postgres + RLS + pgvector)
-- **Hosting:** Vercel (frontend) + Supabase cloud
+- **Hosting:** VPS at `http://64.176.82.100/ims/` + Supabase cloud
 - **AI:** Claude API — server-side only, never client-side
 - **Email:** Resend
 - **WhatsApp:** Meta WhatsApp Business Cloud API
diff --git a/app/(protected)/hse/incidents/[id]/capa/new/page.tsx b/app/(protected)/hse/incidents/[id]/capa/new/page.tsx
index a33ac83..0df9811 100644
--- a/app/(protected)/hse/incidents/[id]/capa/new/page.tsx
+++ b/app/(protected)/hse/incidents/[id]/capa/new/page.tsx
@@ -26,7 +26,7 @@ export default async function NewCapaPage({ params }: Props) {
   const { data: users } = await supabase
     .from('users')
     .select('id, name, department')
-    .not('department', 'is', null)
+    .eq('role', 'capa_owner')
     .order('name')
 
   return (
diff --git a/app/api/admin/users/route.ts b/app/api/admin/users/route.ts
index 3cdfc06..e1b5d92 100644
--- a/app/api/admin/users/route.ts
+++ b/app/api/admin/users/route.ts
@@ -60,8 +60,10 @@ export async function POST(request: NextRequest) {
       )
     newUserId = created.user.id
   } else {
+    const appUrl = process.env.NEXT_PUBLIC_APP_URL ?? 'http://localhost:3000'
     const { data: invited, error: inviteError } = await admin.auth.admin.inviteUserByEmail(email, {
       data: { full_name: body.name ?? '' },
+      redirectTo: `${appUrl}/api/auth/callback`,
     })
     if (inviteError || !invited?.user)
       return NextResponse.json({ error: inviteError?.message ?? 'Invite failed' }, { status: 500 })