diff --git a/website/analytics.test.ts b/website/analytics.test.ts
index 71201d42..05d2fd59 100644
--- a/website/analytics.test.ts
+++ b/website/analytics.test.ts
@@ -95,6 +95,18 @@ describe("ghostget.com analytics contract", () => {
     expect(capture?.properties).toMatchObject({ analytics_schema_version: 2, site_id: "ghostget" });
   });
 
+  test("selects the EU UI only for the exact validated ingestion origin", () => {
+    expect(createBrowserConfig("https://eu.i.posthog.com", home).ui_host).toBe("https://eu.posthog.com");
+    for (const host of [
+      "https://us.i.posthog.com",
+      "https://eu.i.posthog.com.attacker.example",
+      "https://attacker.example/eu.i.posthog.com",
+      "https://attacker.example/?host=eu.i.posthog.com",
+    ]) {
+      expect(createBrowserConfig(host, home).ui_host).toBe("https://us.posthog.com");
+    }
+  });
+
   test("keeps the cookieless, personless, bundled-SDK configuration", () => {
     const config = createBrowserConfig("https://us.i.posthog.com", home);
     expect(config).toMatchObject({
diff --git a/website/source/analytics-contract.ts b/website/source/analytics-contract.ts
index cb0ac072..c3edc7be 100644
--- a/website/source/analytics-contract.ts
+++ b/website/source/analytics-contract.ts
@@ -508,7 +508,7 @@ export function createBrowserConfig(host: string, evidence: BrowserEvidence, isA
     respect_dnt: true,
     // Do not retain a batch that could outlive a visitor’s consent.
     request_batching: false,
-    ui_host: host.includes("eu.i.posthog.com") ? "https://eu.posthog.com" : "https://us.posthog.com",
+    ui_host: host === "https://eu.i.posthog.com" ? "https://eu.posthog.com" : "https://us.posthog.com",
   };
 }