diff --git a/dockerimg/dockerimg.go b/dockerimg/dockerimg.go
index 8c2a4e3..6164a31 100644
--- a/dockerimg/dockerimg.go
+++ b/dockerimg/dockerimg.go
@@ -18,6 +18,7 @@
 	"path/filepath"
 	"runtime"
 	"strings"
+	"sync/atomic"
 	"time"
 
 	"sketch.dev/browser"
@@ -311,13 +312,14 @@
 		}
 
 		// We open the browser after the init config because the above waits for the web server to be serving.
-		if config.OpenBrowser {
-			if config.SkabandAddr != "" {
-				browser.Open(fmt.Sprintf("%s/s/%s", config.SkabandAddr, config.SessionID))
-			} else {
-				browser.Open("http://" + localAddr)
-			}
+		ps1URL := "http://" + localAddr
+		if config.SkabandAddr != "" {
+			ps1URL = fmt.Sprintf("%s/s/%s", config.SkabandAddr, config.SessionID)
 		}
+		if config.OpenBrowser {
+			browser.Open(ps1URL)
+		}
+		gitSrv.ps1URL.Store(&ps1URL)
 	}()
 
 	go func() {
@@ -372,6 +374,7 @@
 	gitPort string
 	srv     *http.Server
 	pass    string
+	ps1URL  atomic.Pointer[string]
 }
 
 func (gs *gitServer) shutdown(ctx context.Context) {
@@ -396,10 +399,11 @@
 	}
 	ret.gitLn = gitLn
 
-	browserC := make(chan string, 1) // channel of URLs to open in browser
+	browserC := make(chan bool, 1) // channel of browser open requests
+
 	go func() {
-		for url := range browserC {
-			browser.Open(url)
+		for range browserC {
+			browser.Open(*ret.ps1URL.Load())
 		}
 	}()
 
diff --git a/dockerimg/githttp.go b/dockerimg/githttp.go
index 6270838..7ce5f40 100644
--- a/dockerimg/githttp.go
+++ b/dockerimg/githttp.go
@@ -3,7 +3,6 @@
 import (
 	"crypto/subtle"
 	"fmt"
-	"io"
 	"log/slog"
 	"net/http"
 	"net/http/cgi"
@@ -15,7 +14,7 @@
 type gitHTTP struct {
 	gitRepoRoot string
 	pass        []byte
-	browserC    chan string // browser launch requests
+	browserC    chan bool // browser launch requests
 }
 
 func (g *gitHTTP) ServeHTTP(w http.ResponseWriter, r *http.Request) {
@@ -54,20 +53,11 @@
 			http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
 			return
 		}
-		body, err := io.ReadAll(r.Body)
-		if err != nil {
-			http.Error(w, "Failed to read request body: "+err.Error(), http.StatusBadRequest)
-			return
-		}
 		defer r.Body.Close()
-		url := strings.TrimSpace(string(body))
-		if len(url) == 0 {
-			http.Error(w, "URL cannot be empty", http.StatusBadRequest)
-			return
-		}
+
 		select {
-		case g.browserC <- string(url):
-			slog.InfoContext(r.Context(), "open browser", "url", url)
+		case g.browserC <- true:
+			slog.InfoContext(r.Context(), "open browser requested")
 			w.WriteHeader(http.StatusOK)
 		default:
 			http.Error(w, "Too many browser launch requests", http.StatusTooManyRequests)
diff --git a/loop/agent.go b/loop/agent.go
index 3da8e94..042d9a5 100644
--- a/loop/agent.go
+++ b/loop/agent.go
@@ -491,10 +491,11 @@
 	}
 	// We're in Docker, need to send a request to the Git server
 	// to signal that the outer process should open the browser.
+	// We don't get to specify a URL, because we are untrusted.
 	httpc := &http.Client{Timeout: 5 * time.Second}
-	resp, err := httpc.Post(a.outsideHTTP+"/browser", "text/plain", strings.NewReader(url))
+	resp, err := httpc.Post(a.outsideHTTP+"/browser", "text/plain", nil)
 	if err != nil {
-		slog.Debug("browser launch request connection failed", "err", err, "url", url)
+		slog.Debug("browser launch request connection failed", "err", err)
 		return
 	}
 	defer resp.Body.Close()