diff --git a/next.config.ts b/next.config.ts
index c51e6b1f..847028f2 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -50,6 +50,10 @@ const nextConfig: NextConfig = {
   cleanDistDir: true,
   env: {
     NEXT_PUBLIC_PAGESPEED_API_KEY: process.env.NEXT_PUBLIC_PAGESPEED_API_KEY,
+    // Deploy workflows omit NEXT_PUBLIC_BASE_PATH and rely on detect-project.js,
+    // so the resolved basePath must be injected here or client code that builds
+    // URLs (auth redirects) sees '' in production (issue #154).
+    NEXT_PUBLIC_BASE_PATH: basePath,
   },
   webpack: (config, { isServer }) => {
     // Optimize code splitting for better performance
diff --git a/src/app/reset-password/page.tsx b/src/app/reset-password/page.tsx
index f42b0feb..966991db 100644
--- a/src/app/reset-password/page.tsx
+++ b/src/app/reset-password/page.tsx
@@ -2,6 +2,7 @@
 
 import React from 'react';
 import ResetPasswordForm from '@/components/auth/ResetPasswordForm';
+import { getInternalUrl } from '@/config/project.config';
 
 export default function ResetPasswordPage() {
   return (
@@ -12,7 +13,7 @@ export default function ResetPasswordPage() {
         </h1>
 
         <ResetPasswordForm
-          onSuccess={() => (window.location.href = '/sign-in')}
+          onSuccess={() => (window.location.href = getInternalUrl('/sign-in'))}
         />
       </div>
     </main>
diff --git a/src/app/sign-up/page.tsx b/src/app/sign-up/page.tsx
index 86b9b593..fc996499 100644
--- a/src/app/sign-up/page.tsx
+++ b/src/app/sign-up/page.tsx
@@ -4,6 +4,7 @@ import React, { useState, useEffect } from 'react';
 import SignUpForm from '@/components/auth/SignUpForm';
 import OAuthButtons from '@/components/auth/OAuthButtons';
 import Link from 'next/link';
+import { getInternalUrl } from '@/config/project.config';
 
 function isSafeRedirectUrl(url: string): boolean {
   if (!url || !url.startsWith('/')) return false;
@@ -36,7 +37,9 @@ export default function SignUpPage() {
         </h1>
 
         <SignUpForm
-          onSuccess={() => (window.location.href = '/verify-email')}
+          onSuccess={() =>
+            (window.location.href = getInternalUrl('/verify-email'))
+          }
         />
 
         <div className="divider my-6">OR</div>
diff --git a/src/components/ErrorBoundary.tsx b/src/components/ErrorBoundary.tsx
index 1db097e1..ce685f3e 100644
--- a/src/components/ErrorBoundary.tsx
+++ b/src/components/ErrorBoundary.tsx
@@ -6,6 +6,7 @@ import errorHandler, {
   ErrorSeverity,
   ErrorCategory,
 } from '@/utils/error-handler';
+import { getInternalUrl } from '@/config/project.config';
 
 interface Props {
   children: ReactNode;
@@ -280,7 +281,7 @@ class ErrorBoundary extends Component<Props, State> {
                 </button>
                 {level === 'page' && (
                   <button
-                    onClick={() => (window.location.href = '/')}
+                    onClick={() => (window.location.href = getInternalUrl('/'))}
                     className="btn btn-ghost btn-sm"
                   >
                     Go Home
diff --git a/src/components/auth/ForgotPasswordForm/ForgotPasswordForm.tsx b/src/components/auth/ForgotPasswordForm/ForgotPasswordForm.tsx
index 267c4c9b..d2dbab08 100644
--- a/src/components/auth/ForgotPasswordForm/ForgotPasswordForm.tsx
+++ b/src/components/auth/ForgotPasswordForm/ForgotPasswordForm.tsx
@@ -9,6 +9,7 @@ import {
 } from '@/lib/auth/rate-limit-check';
 import { validateEmail } from '@/lib/auth/email-validator';
 import { logAuthEvent } from '@/lib/auth/audit-logger';
+import { getRedirectUrl } from '@/config/project.config';
 
 export interface ForgotPasswordFormProps {
   /** Callback on success */
@@ -63,7 +64,7 @@ export default function ForgotPasswordForm({
     const { error: resetError } = await supabase.auth.resetPasswordForEmail(
       email,
       {
-        redirectTo: `${window.location.origin}/reset-password`,
+        redirectTo: getRedirectUrl('/reset-password'),
       }
     );
 
diff --git a/src/components/auth/OAuthButtons/OAuthButtons.tsx b/src/components/auth/OAuthButtons/OAuthButtons.tsx
index e75f1513..2832846c 100644
--- a/src/components/auth/OAuthButtons/OAuthButtons.tsx
+++ b/src/components/auth/OAuthButtons/OAuthButtons.tsx
@@ -3,6 +3,7 @@
 import React, { useState } from 'react';
 import { createClient } from '@/lib/supabase/client';
 import { createLogger } from '@/lib/logger/logger';
+import { getRedirectUrl } from '@/config/project.config';
 
 const logger = createLogger('components:auth:OAuthButtons');
 
@@ -30,7 +31,7 @@ export default function OAuthButtons({ className = '' }: OAuthButtonsProps) {
       await supabase.auth.signInWithOAuth({
         provider,
         options: {
-          redirectTo: `${window.location.origin}/auth/callback`,
+          redirectTo: getRedirectUrl('/auth/callback'),
         },
       });
     } catch (error) {
diff --git a/src/components/auth/SignInForm/SignInForm.tsx b/src/components/auth/SignInForm/SignInForm.tsx
index f5a39999..49ca89c2 100644
--- a/src/components/auth/SignInForm/SignInForm.tsx
+++ b/src/components/auth/SignInForm/SignInForm.tsx
@@ -9,6 +9,7 @@ import {
 } from '@/lib/auth/rate-limit-check';
 import { validateEmail } from '@/lib/auth/email-validator';
 import { logAuthEvent } from '@/lib/auth/audit-logger';
+import { getInternalUrl } from '@/config/project.config';
 import { createLogger } from '@/lib/logger/logger';
 
 const logger = createLogger('components:auth:SignInForm');
@@ -91,7 +92,7 @@ export default function SignInForm({
     if (signInError) {
       // Check if email needs verification
       if (signInError.message.toLowerCase().includes('email not confirmed')) {
-        window.location.href = '/verify-email';
+        window.location.href = getInternalUrl('/verify-email');
         return;
       }
 
diff --git a/src/config/__tests__/project.config.test.ts b/src/config/__tests__/project.config.test.ts
index b7b627e4..a5aae2b8 100644
--- a/src/config/__tests__/project.config.test.ts
+++ b/src/config/__tests__/project.config.test.ts
@@ -3,6 +3,8 @@ import {
   getProjectConfig,
   isGitHubPages,
   getAssetUrl,
+  getInternalUrl,
+  getRedirectUrl,
   generateManifest,
   projectConfig,
 } from '../project.config';
@@ -178,6 +180,52 @@ describe('Project Configuration', () => {
     });
   });
 
+  describe('getInternalUrl / getRedirectUrl (issue #154)', () => {
+    it('prefixes basePath and canonicalizes the trailing slash', () => {
+      process.env.NEXT_PUBLIC_BASE_PATH = '/RescueDogs';
+
+      expect(getInternalUrl('/')).toBe('/RescueDogs/');
+      expect(getInternalUrl('/auth/callback')).toBe(
+        '/RescueDogs/auth/callback/'
+      );
+      expect(getInternalUrl('/auth/callback/')).toBe(
+        '/RescueDogs/auth/callback/'
+      );
+      expect(getInternalUrl('auth/callback')).toBe(
+        '/RescueDogs/auth/callback/'
+      );
+    });
+
+    it('degrades to the bare path when basePath is unset', () => {
+      delete process.env.NEXT_PUBLIC_BASE_PATH;
+
+      expect(getInternalUrl('/')).toBe('/');
+      expect(getInternalUrl('/verify-email')).toBe('/verify-email/');
+    });
+
+    it('leaves paths with a query or hash unsuffixed', () => {
+      process.env.NEXT_PUBLIC_BASE_PATH = '/RescueDogs';
+
+      expect(getInternalUrl('/sign-in?error=auth_callback_failed')).toBe(
+        '/RescueDogs/sign-in?error=auth_callback_failed'
+      );
+      expect(getInternalUrl('/page#section')).toBe('/RescueDogs/page#section');
+    });
+
+    it('builds absolute Supabase redirect URLs from the runtime origin plus basePath', () => {
+      process.env.NEXT_PUBLIC_BASE_PATH = '/RescueDogs';
+
+      expect(getRedirectUrl('/auth/callback')).toBe(
+        'http://localhost:3000/RescueDogs/auth/callback/'
+      );
+
+      delete process.env.NEXT_PUBLIC_BASE_PATH;
+      expect(getRedirectUrl('/auth/callback')).toBe(
+        'http://localhost:3000/auth/callback/'
+      );
+    });
+  });
+
   describe('generateManifest', () => {
     it('should generate a valid PWA manifest', () => {
       const manifest = generateManifest();
diff --git a/src/config/project.config.ts b/src/config/project.config.ts
index cc48dd2b..89470b23 100644
--- a/src/config/project.config.ts
+++ b/src/config/project.config.ts
@@ -88,6 +88,39 @@ export function getAssetUrl(path: string): string {
   return `${config.basePath}${cleanPath}`;
 }
 
+/**
+ * Normalize a page path: leading slash always; trailing slash unless the
+ * path carries a query/hash (trailingSlash: true exports emit
+ * `route/index.html`, so the canonical page URL ends in `/` — hitting the
+ * slashless form costs a GitHub Pages 301 that Supabase's exact-match
+ * redirect allow-list won't recognize).
+ */
+function normalizePagePath(path: string): string {
+  const withLeading = path.startsWith('/') ? path : `/${path}`;
+  if (/[?#]/.test(withLeading)) return withLeading;
+  return withLeading.endsWith('/') ? withLeading : `${withLeading}/`;
+}
+
+/**
+ * basePath-prefixed path for hard navigations (window.location.href).
+ * next/navigation's router prepends basePath automatically; raw
+ * window.location assignments do not — on a GitHub Pages project site a
+ * bare '/' escapes the app to the domain root (issue #154).
+ */
+export function getInternalUrl(path: string): string {
+  const config = getProjectConfig();
+  return `${config.basePath}${normalizePagePath(path)}`;
+}
+
+/**
+ * Absolute URL for Supabase redirect params (emailRedirectTo, redirectTo).
+ * Client-only: composes the runtime origin with the build-time basePath,
+ * which is self-consistent for the bundle actually being served.
+ */
+export function getRedirectUrl(path: string): string {
+  return `${window.location.origin}${getInternalUrl(path)}`;
+}
+
 // Helper function for dynamic manifest generation
 export function generateManifest() {
   const config = getProjectConfig();
diff --git a/src/contexts/AuthContext.tsx b/src/contexts/AuthContext.tsx
index 7c96f407..cd7ca4fb 100644
--- a/src/contexts/AuthContext.tsx
+++ b/src/contexts/AuthContext.tsx
@@ -16,6 +16,7 @@ import React, {
 } from 'react';
 import { User, Session } from '@supabase/supabase-js';
 import { supabase, setAllowAuthTokenRemoval } from '@/lib/supabase/client';
+import { getInternalUrl, getRedirectUrl } from '@/config/project.config';
 import { useIdleTimeout } from '@/hooks/useIdleTimeout';
 import { retryWithBackoff } from '@/lib/auth/retry-utils';
 import { createLogger } from '@/lib/logger';
@@ -233,8 +234,14 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
       // sign-out AND the auth-token is gone/expired (we cleared it in
       // another tab, or the refresh token was revoked server-side).
       if (_event === 'SIGNED_OUT' && !isLocalSignOut.current) {
-        logger.info('Cross-tab sign-out detected, redirecting to home');
-        window.location.href = '/';
+        // Never hijack the confirmation/OAuth landing page: during email
+        // confirmation no auth-token exists yet, so a transient SIGNED_OUT
+        // passes the validity guard above — and the callback page owns its
+        // own error/redirect handling (issue #154).
+        if (!window.location.pathname.includes('/auth/callback')) {
+          logger.info('Cross-tab sign-out detected, redirecting to home');
+          window.location.href = getInternalUrl('/');
+        }
         return;
       }
 
@@ -267,7 +274,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
         email,
         password,
         options: {
-          emailRedirectTo: `${window.location.origin}/auth/callback`,
+          emailRedirectTo: getRedirectUrl('/auth/callback'),
         },
       });
       return { error };
@@ -313,7 +320,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
     }
 
     // FR-005: Force page reload to clear any stale React state
-    window.location.href = '/';
+    window.location.href = getInternalUrl('/');
   }, []);
 
   const refreshSession = useCallback(async () => {
diff --git a/tests/unit/auth/use-auth.test.tsx b/tests/unit/auth/use-auth.test.tsx
index 115871e8..8ef48865 100644
--- a/tests/unit/auth/use-auth.test.tsx
+++ b/tests/unit/auth/use-auth.test.tsx
@@ -3,7 +3,7 @@
  * Tests the useAuth hook and AuthProvider
  */
 
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { renderHook, waitFor } from '@testing-library/react';
 
 // Mock Supabase client first (this needs to be hoisted)
@@ -229,4 +229,131 @@ describe('useAuth', () => {
 
     expect(error).toEqual(mockError);
   });
+
+  describe('basePath-aware redirects (issue #154)', () => {
+    const originalBasePath = process.env.NEXT_PUBLIC_BASE_PATH;
+
+    const stubLocation = (pathname: string) => {
+      // Repo-standard jsdom location stub (see ReAuthModal.test.tsx) —
+      // records href assignments instead of navigating.
+      Object.defineProperty(window, 'location', {
+        value: {
+          href: `http://localhost:3000${pathname}`,
+          origin: 'http://localhost:3000',
+          pathname,
+        },
+        writable: true,
+        configurable: true,
+      });
+      return window.location;
+    };
+
+    beforeEach(() => {
+      process.env.NEXT_PUBLIC_BASE_PATH = '/RescueDogs';
+      localStorage.clear();
+    });
+
+    afterEach(() => {
+      if (originalBasePath === undefined) {
+        delete process.env.NEXT_PUBLIC_BASE_PATH;
+      } else {
+        process.env.NEXT_PUBLIC_BASE_PATH = originalBasePath;
+      }
+    });
+
+    it('sends a basePath-prefixed emailRedirectTo at sign-up', async () => {
+      stubLocation('/RescueDogs/sign-up/');
+
+      const { result } = renderHook(() => useAuth(), {
+        wrapper: AuthProvider,
+      });
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+      });
+
+      await result.current.signUp('test@example.com', 'password123');
+
+      expect(supabase.auth.signUp).toHaveBeenCalledWith({
+        email: 'test@example.com',
+        password: 'password123',
+        options: {
+          emailRedirectTo: 'http://localhost:3000/RescueDogs/auth/callback/',
+        },
+      });
+    });
+
+    it('redirects signOut to the basePath root, not the domain root', async () => {
+      const loc = stubLocation('/RescueDogs/profile/');
+
+      const { result } = renderHook(() => useAuth(), {
+        wrapper: AuthProvider,
+      });
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+      });
+
+      await result.current.signOut();
+
+      expect(loc.href).toBe('/RescueDogs/');
+    });
+
+    it('redirects a real cross-tab SIGNED_OUT to the basePath root', async () => {
+      const loc = stubLocation('/RescueDogs/profile/');
+
+      let authStateCallback: any;
+      vi.mocked(supabase.auth.onAuthStateChange).mockImplementation(
+        (callback) => {
+          authStateCallback = callback;
+          return {
+            data: { subscription: { unsubscribe: vi.fn() } },
+          } as any;
+        }
+      );
+
+      const { result } = renderHook(() => useAuth(), {
+        wrapper: AuthProvider,
+      });
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+      });
+
+      // No sb-*-auth-token in localStorage, so this SIGNED_OUT is "real"
+      await authStateCallback('SIGNED_OUT', null);
+
+      expect(loc.href).toBe('/RescueDogs/');
+    });
+
+    it('never redirects a SIGNED_OUT fired on the auth callback page', async () => {
+      const loc = stubLocation('/RescueDogs/auth/callback/');
+      const hrefBefore = loc.href;
+
+      let authStateCallback: any;
+      vi.mocked(supabase.auth.onAuthStateChange).mockImplementation(
+        (callback) => {
+          authStateCallback = callback;
+          return {
+            data: { subscription: { unsubscribe: vi.fn() } },
+          } as any;
+        }
+      );
+
+      const { result } = renderHook(() => useAuth(), {
+        wrapper: AuthProvider,
+      });
+
+      await waitFor(() => {
+        expect(result.current.isLoading).toBe(false);
+      });
+
+      // During email confirmation no auth-token exists yet, so a transient
+      // SIGNED_OUT passes the validity guard — it must not hijack the
+      // callback page (the pre-#154 bounce to the domain root).
+      await authStateCallback('SIGNED_OUT', null);
+
+      expect(loc.href).toBe(hrefBefore);
+    });
+  });
 });