diff --git a/molecule/kibana_custom/converge.yml b/molecule/kibana_custom/converge.yml
index 1f8e1152..88cb69e1 100644
--- a/molecule/kibana_custom/converge.yml
+++ b/molecule/kibana_custom/converge.yml
@@ -12,6 +12,7 @@
     # Kibana custom settings
     kibana_config_backup: true
     kibana_sniff_on_start: true
+    kibana_public_base_url: "https://kibana.example.com"
     kibana_extra_config: |-
       ops.interval: 10000
       logging.root.level: warn
diff --git a/molecule/kibana_custom/verify.yml b/molecule/kibana_custom/verify.yml
index de04ef16..0015b35a 100644
--- a/molecule/kibana_custom/verify.yml
+++ b/molecule/kibana_custom/verify.yml
@@ -72,6 +72,13 @@
               - "'logging.root.level: warn' in (kibana_yml.content | b64decode)"
             fail_msg: "Extra config not found in kibana.yml"
 
+        - name: Verify kibana_public_base_url override is applied verbatim
+          ansible.builtin.assert:
+            that:
+              - "'server.publicBaseUrl: \"https://kibana.example.com\"' in (kibana_yml.content | b64decode)"
+              - "'kibana.example.com:5601' not in (kibana_yml.content | b64decode)"
+            fail_msg: "kibana_public_base_url override not honoured in kibana.yml"
+
         - name: Verify sniff on start is enabled (pre-9.x only)
           ansible.builtin.assert:
             that:
diff --git a/roles/kibana/defaults/main.yml b/roles/kibana/defaults/main.yml
index 12ad5d86..a5a3800f 100644
--- a/roles/kibana/defaults/main.yml
+++ b/roles/kibana/defaults/main.yml
@@ -74,6 +74,14 @@ kibana_tls_remote_src: false
 # @end
 # kibana_server_protocol: ""
 
+# @var kibana_public_base_url:description: >
+#   Explicit value for server.publicBaseUrl, used verbatim. Set this when Kibana
+#   runs behind a reverse proxy on a different host/port than the node itself
+#   (the generated default is "<scheme>://<host>:<port>"). Empty = use the
+#   generated default.
+# @end
+kibana_public_base_url: ""
+
 # @var kibana_sniff_on_start:description: >
 #   Discover all Elasticsearch nodes in the cluster on Kibana startup.
 #   Deprecated: removed in Elasticsearch/Kibana 9.x. Will be dropped in a future release.
diff --git a/roles/kibana/templates/kibana.yml.j2 b/roles/kibana/templates/kibana.yml.j2
index de15f6b5..5bc626b2 100644
--- a/roles/kibana/templates/kibana.yml.j2
+++ b/roles/kibana/templates/kibana.yml.j2
@@ -1,7 +1,11 @@
 {{ ansible_managed | comment }}
 
 server.host: "0.0.0.0"
+{% if kibana_public_base_url is defined and kibana_public_base_url | length > 0 %}
+server.publicBaseUrl: "{{ kibana_public_base_url }}"
+{% else %}
 server.publicBaseUrl: "http{% if kibana_tls | bool %}s{% endif %}://{{ elasticstack_kibana_host | default( ansible_facts.fqdn ) }}:{{ elasticstack_kibana_port }}"
+{% endif %}
 {% if kibana_server_protocol is defined and kibana_server_protocol | length > 0 %}
 server.protocol: "{{ kibana_server_protocol }}"
 {% endif %}