diff --git a/server/src/services/system-config.service.spec.ts b/server/src/services/system-config.service.spec.ts
index 176e6d6f04..e83e8aff48 100644
--- a/server/src/services/system-config.service.spec.ts
+++ b/server/src/services/system-config.service.spec.ts
@@ -345,6 +345,11 @@ describe(SystemConfigService.name, () => {
       { should: 'with a trailing slash', externalDomain: 'https://demo.immich.app/' },
       { should: 'without a trailing slash', externalDomain: 'https://demo.immich.app' },
       { should: 'with a port', externalDomain: 'https://demo.immich.app:42', result: 'https://demo.immich.app:42' },
+      {
+        should: 'with basic auth',
+        externalDomain: 'https://user:password@example.com:123',
+        result: 'https://user:password@example.com:123',
+      },
     ];
 
     for (const { should, externalDomain, result } of externalDomainTests) {
diff --git a/server/src/utils/config.ts b/server/src/utils/config.ts
index 4dee1c348e..bc1d2dae1b 100644
--- a/server/src/utils/config.ts
+++ b/server/src/utils/config.ts
@@ -116,7 +116,14 @@ const buildConfig = async (repos: RepoDeps) => {
   const config = instanceToPlain(instance) as SystemConfig;
 
   if (config.server.externalDomain.length > 0) {
-    config.server.externalDomain = new URL(config.server.externalDomain).origin;
+    const domain = new URL(config.server.externalDomain);
+
+    let externalDomain = domain.origin;
+    if (domain.password && domain.username) {
+      externalDomain = `${domain.protocol}//${domain.username}:${domain.password}@${domain.host}`;
+    }
+
+    config.server.externalDomain = externalDomain;
   }
 
   if (!config.ffmpeg.acceptedVideoCodecs.includes(config.ffmpeg.targetVideoCodec)) {