diff --git a/scripts/patch-listening-endpoint-runtime-guards.mjs b/scripts/patch-listening-endpoint-runtime-guards.mjs
index 0f52c39b..bafb7ec6 100644
--- a/scripts/patch-listening-endpoint-runtime-guards.mjs
+++ b/scripts/patch-listening-endpoint-runtime-guards.mjs
@@ -778,6 +778,33 @@ const patchSpecs = [
       "node_modules/@indiekit/indiekit/node_modules/@rmdes/indiekit-endpoint-funkwhale/index.js",
     ],
   },
+  {
+    name: "funkwhale-cover-proxy-internal-url-rewrite",
+    marker: "Rewrite media URLs to internal endpoint when node jail can't reach public hostname",
+    oldSnippet: `      try { urlObj = new URL(rawUrl); } catch { return response.status(400).send("Invalid url"); }
+      try {
+        const upstream = await fetch(rawUrl, {`,
+    newSnippet: `      try { urlObj = new URL(rawUrl); } catch { return response.status(400).send("Invalid url"); }
+
+      // Rewrite media URLs to internal endpoint when node jail can't reach public hostname
+      let fetchUrl = rawUrl;
+      const { funkwhaleConfig } = request.app.locals.application;
+      if (funkwhaleConfig?.mediaInternalUrl && funkwhaleConfig?.instanceUrl) {
+        try {
+          const instanceHost = new URL(funkwhaleConfig.instanceUrl).hostname;
+          if (urlObj.hostname === instanceHost) {
+            fetchUrl = funkwhaleConfig.mediaInternalUrl.replace(/\\/+$/, "") + urlObj.pathname + urlObj.search;
+          }
+        } catch {}
+      }
+
+      try {
+        const upstream = await fetch(fetchUrl, {`,
+    candidates: [
+      "node_modules/@rmdes/indiekit-endpoint-funkwhale/index.js",
+      "node_modules/@indiekit/indiekit/node_modules/@rmdes/indiekit-endpoint-funkwhale/index.js",
+    ],
+  },
 ];
 
 async function exists(filePath) {