diff --git a/terraform/ui.tf b/terraform/ui.tf
index 361aef4..6584572 100644
--- a/terraform/ui.tf
+++ b/terraform/ui.tf
@@ -73,13 +73,18 @@ resource "aws_s3_object" "index" {
   content_type = "text/html"
 }
 
-# Injected config: the demo orchestrator endpoint the UI calls.
+# Injected config: the endpoint the UI posts to. Defaults to the backend /demo
+# round trip; set var.ui_gateway_url to point the browser at Fusion instead.
+locals {
+  ui_endpoint = var.ui_gateway_url != "" ? var.ui_gateway_url : "${trimsuffix(aws_apigatewayv2_stage.default.invoke_url, "/")}/demo"
+}
+
 resource "aws_s3_object" "config" {
   bucket       = aws_s3_bucket.ui.id
   key          = "config.js"
-  content      = "window.DEMO_ENDPOINT = \"${trimsuffix(aws_apigatewayv2_stage.default.invoke_url, "/")}/demo\";\n"
+  content      = "window.DEMO_ENDPOINT = \"${local.ui_endpoint}\";\n"
   content_type = "application/javascript"
-  etag         = md5("${trimsuffix(aws_apigatewayv2_stage.default.invoke_url, "/")}/demo")
+  etag         = md5(local.ui_endpoint)
 }
 
 output "ui_url" { value = "https://${aws_cloudfront_distribution.ui.domain_name}" }
diff --git a/terraform/variables.tf b/terraform/variables.tf
index 8f50150..9f8fb99 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -50,3 +50,11 @@ variable "agent_runtime_arn" {
   type        = string
   default     = ""
 }
+
+# Where the browser UI posts. Empty -> backend /demo. Set to the Fusion endpoint
+# to run the portal through the gateway (Fusion must return CORS for the UI origin).
+variable "ui_gateway_url" {
+  description = "Endpoint the UI posts to (empty = backend /demo round trip)."
+  type        = string
+  default     = ""
+}