diff --git a/app/controllers/api/v1/customers_controller.rb b/app/controllers/api/v1/customers_controller.rb
index 05cdafeb7593..d7698c96fe22 100644
--- a/app/controllers/api/v1/customers_controller.rb
+++ b/app/controllers/api/v1/customers_controller.rb
@@ -19,7 +19,7 @@ def create
       def portal_url
         customer = current_organization.customers.find_by(external_id: params[:customer_external_id])
 
-        result = ::CustomerPortal::GenerateUrlService.call(customer:)
+        result = ::CustomerPortal::GenerateUrlService.call(customer:, return_to: params[:return_to])
 
         if result.success?
           render(
diff --git a/app/services/customer_portal/generate_url_service.rb b/app/services/customer_portal/generate_url_service.rb
index 635e338ddffd..e2f2a6c992ed 100644
--- a/app/services/customer_portal/generate_url_service.rb
+++ b/app/services/customer_portal/generate_url_service.rb
@@ -2,8 +2,9 @@
 
 module CustomerPortal
   class GenerateUrlService < BaseService
-    def initialize(customer:)
+    def initialize(customer:, return_to: nil)
       @customer = customer
+      @return_to = return_to
 
       super
     end
@@ -14,13 +15,20 @@ def call
       public_authenticator = ActiveSupport::MessageVerifier.new(ENV["SECRET_KEY_BASE"])
       message = public_authenticator.generate(customer.id, expires_in: 12.hours)
 
-      result.url = "#{ENV["LAGO_FRONT_URL"]}/customer-portal/#{message}"
+      url = "#{ENV["LAGO_FRONT_URL"]}/customer-portal/#{message}"
+      # return_to lets the host app self-heal a stale portal tab: when the
+      # JWT expires, lago-front bounces back to this URL with ?refresh=1 so
+      # the host app's billing page can mint a fresh URL.
+      if return_to.present?
+        url += "?return_to=#{CGI.escape(return_to)}"
+      end
+      result.url = url
 
       result
     end
 
     private
 
-    attr_reader :customer
+    attr_reader :customer, :return_to
   end
 end