diff --git a/datasette_auth_passwords/__init__.py b/datasette_auth_passwords/__init__.py
index 08f067c..ea47dfb 100644
--- a/datasette_auth_passwords/__init__.py
+++ b/datasette_auth_passwords/__init__.py
@@ -42,7 +42,7 @@ async def password_login(request, datasette):
         password_hash = accounts.get(username)
         if password_hash and verify_password(password, password_hash):
             actor = actors.get(username) or {"id": username}
-            response = Response.redirect("/")
+            response = Response.redirect(datasette.urls.path("/"))
             response.set_cookie("ds_actor", datasette.sign({"a": actor}, "actor"))
             return response
         else:
diff --git a/datasette_auth_passwords/templates/password_login.html b/datasette_auth_passwords/templates/password_login.html
index ba201d1..f0c2bec 100644
--- a/datasette_auth_passwords/templates/password_login.html
+++ b/datasette_auth_passwords/templates/password_login.html
@@ -28,7 +28,7 @@ <h1>Log in</h1>
     <p class="message-error">{{ error }}</p>
 {% endif %}
 
-<form class="password-login" action="/-/login" method="post">
+<form class="password-login" action="{{ urls.path("/-/login") }}" method="post">
     <div>
         <p>
             <label for="id_username">Username</label>