diff --git a/scripts/patch-listening-endpoint-runtime-guards.mjs b/scripts/patch-listening-endpoint-runtime-guards.mjs
index bafb7ec6..36889de9 100644
--- a/scripts/patch-listening-endpoint-runtime-guards.mjs
+++ b/scripts/patch-listening-endpoint-runtime-guards.mjs
@@ -786,16 +786,13 @@ const patchSpecs = [
         const upstream = await fetch(rawUrl, {`,
     newSnippet: `      try { urlObj = new URL(rawUrl); } catch { return response.status(400).send("Invalid url"); }
 
-      // Rewrite media URLs to internal endpoint when node jail can't reach public hostname
+      // Rewrite media URLs to internal endpoint when node jail can't reach public hostname.
+      // FUNKWHALE_INSTANCE may use an internal IP while media URLs use the public hostname,
+      // so we match by path prefix (/media/) rather than by hostname.
       let fetchUrl = rawUrl;
       const { funkwhaleConfig } = request.app.locals.application;
-      if (funkwhaleConfig?.mediaInternalUrl && funkwhaleConfig?.instanceUrl) {
-        try {
-          const instanceHost = new URL(funkwhaleConfig.instanceUrl).hostname;
-          if (urlObj.hostname === instanceHost) {
-            fetchUrl = funkwhaleConfig.mediaInternalUrl.replace(/\\/+$/, "") + urlObj.pathname + urlObj.search;
-          }
-        } catch {}
+      if (funkwhaleConfig?.mediaInternalUrl && urlObj.pathname.startsWith("/media/")) {
+        fetchUrl = funkwhaleConfig.mediaInternalUrl.replace(/\\/+$/, "") + urlObj.pathname + (urlObj.search || "");
       }
 
       try {