diff --git a/hosting/kubernetes/budibase/templates/app-service-deployment.yaml b/hosting/kubernetes/budibase/templates/app-service-deployment.yaml
index 5d9aee2619..98fdc8dfd0 100644
--- a/hosting/kubernetes/budibase/templates/app-service-deployment.yaml
+++ b/hosting/kubernetes/budibase/templates/app-service-deployment.yaml
@@ -96,6 +96,10 @@ spec:
           value: worker-service:{{ .Values.services.worker.port }}
         - name: COOKIE_DOMAIN
           value: {{ .Values.globals.cookieDomain | quote }}
+        - name: ACCOUNT_PORTAL_URL
+          value: {{ .Values.globals.accountPortalUrl | quote }}
+        - name: ACCOUNT_PORTAL_API_KEY
+          value: {{ .Values.globals.accountPortalApiKey | quote }}
         image: budibase/apps
         imagePullPolicy: Always
         name: bbapps
diff --git a/packages/builder/src/pages/builder/_layout.svelte b/packages/builder/src/pages/builder/_layout.svelte
index 625071c07e..7888d7a7e0 100644
--- a/packages/builder/src/pages/builder/_layout.svelte
+++ b/packages/builder/src/pages/builder/_layout.svelte
@@ -20,25 +20,29 @@
       return
     }
 
+    // e.g. ['tenant', 'budibase', 'app'] vs ['budibase', 'app']
+    let urlTenantId
+    const hostParts = host.split(".")
+    if (hostParts.length > 2) {
+      urlTenantId = hostParts[0]
+    }
+
+    // no tenant in the url - send to account portal to fix this
+    if (!urlTenantId) {
+      window.location.href = $admin.accountPortalUrl
+      return
+    }
+
     if (user && user.tenantId) {
-      let urlTenantId
-      const hostParts = host.split(".")
-
-      // only run validation when we know we are in a tenant url
-      // not when we visit the root budibase.app domain
-      // e.g. ['tenant', 'budibase', 'app'] vs ['budibase', 'app']
-      if (hostParts.length > 2) {
-        urlTenantId = hostParts[0]
-      } else {
-        // no tenant in the url - send to account portal to fix this
-        window.location.href = $admin.accountPortalUrl
-        return
-      }
-
       if (user.tenantId !== urlTenantId) {
         // user should not be here - play it safe and log them out
         await auth.logout()
+        await auth.setOrganisation(null)
+        return
       }
+    } else {
+      // no user - set the org according to the url
+      await auth.setOrganisation(urlTenantId)
     }
   }