diff --git a/index.js b/index.js
index e5e29b9..08ec9ea 100644
--- a/index.js
+++ b/index.js
@@ -33,6 +33,8 @@ const fs = require('fs');
 const app = express();
 const port = 3000;
 const env = {};
+const { stringReplace } = require('string-replace-middleware');
+require('dotenv').config();
 
 md.use(require("markdown-it-anchor"));
 md.use(require("markdown-it-table-of-contents"), { "includeLevel": [2, 3], "listType": "ol" });
@@ -41,6 +43,12 @@ md.use(require('markdown-it-title'));
 app.set('view engine', 'pug');
 app.use('/favicon.svg', express.static('favicon.svg'));
 
+app.use(stringReplace({
+    PLACEHOLDER__XMPP_VCARD_SERVER_DOMAIN: process.env.XMPP_VCARD_SERVER_DOMAIN ? process.env.XMPP_VCARD_SERVER_DOMAIN : 'xmpp-vcard.keyoxide.org'
+}, {
+    contentTypeFilterRegexp: /application\/javascript/,
+}));
+
 app.use('/', require('./routes/main'));
 app.use('/static', require('./routes/static'));
 app.use('/server', require('./routes/server'));
@@ -51,5 +59,5 @@ app.use('/util', require('./routes/util'));
 app.use('/', require('./routes/profile'));
 
 app.listen(port, () => {
-  console.log(`Example app listening at http://localhost:${port}`);
+    console.log(`Example app listening at http://localhost:${port}`);
 });
diff --git a/package-lock.json b/package-lock.json
index 92bf195..e2e57cb 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,6 +1,6 @@
 {
   "name": "keyoxide-web",
-  "version": "1.0.0",
+  "version": "2.0.2",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
@@ -227,6 +227,11 @@
       "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
       "integrity": "sha1-Aljq5NPQwJdN4cFpGI7wBR0dGYg="
     },
+    "escape-string-regexp": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
+      "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA=="
+    },
     "etag": {
       "version": "1.8.1",
       "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
@@ -312,6 +317,11 @@
       "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.0.1.tgz",
       "integrity": "sha512-PLcsoqu++dmEIZB+6totNFKq/7Do+Z0u4oT0zKOJNl3lYK6vGwwu2hjHs+68OEZbTjiUE9bgOABXbP/GvrS0Kg=="
     },
+    "hijackresponse": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/hijackresponse/-/hijackresponse-4.0.0.tgz",
+      "integrity": "sha512-ilL2k2/k9NXk4QCx7dz7pV+ZRL8aOX9ZiaVD+5nql1fF5WdKNhXbPh4shyfICpgHoHiD4FKZ1jLgNKYDYhy0Yw=="
+    },
     "http-errors": {
       "version": "1.7.2",
       "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.7.2.tgz",
@@ -1315,6 +1325,15 @@
       "resolved": "https://registry.npmjs.org/statuses/-/statuses-1.5.0.tgz",
       "integrity": "sha1-Fhx9rBd2Wf2YEfQ3cfqZOBR4Yow="
     },
+    "string-replace-middleware": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/string-replace-middleware/-/string-replace-middleware-1.0.2.tgz",
+      "integrity": "sha512-AZBPVPJ0A3DhBleAGjA8qAoL0hEKxb7C5QUYr9VnzCO+COEqI6tyGDe2a+A3odJc5uRDT/CPKdbH8oe5laCv/g==",
+      "requires": {
+        "escape-string-regexp": "^4.0.0",
+        "hijackresponse": "^4.0.0"
+      }
+    },
     "to-fast-properties": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/to-fast-properties/-/to-fast-properties-2.0.0.tgz",
diff --git a/package.json b/package.json
index 2e5df20..2fe19a3 100644
--- a/package.json
+++ b/package.json
@@ -13,7 +13,8 @@
     "markdown-it-table-of-contents": "^0.4.4",
     "markdown-it-title": "^3.0.0",
     "openpgp": "^4.10.7",
-    "pug": "^3.0.0"
+    "pug": "^3.0.0",
+    "string-replace-middleware": "^1.0.2"
   },
   "devDependencies": {
     "license-check-and-add": "^3.0.4"
diff --git a/static/scripts.js b/static/scripts.js
index 1f8ca7b..942b88c 100644
--- a/static/scripts.js
+++ b/static/scripts.js
@@ -437,7 +437,7 @@ async function verifyProof(url, fingerprint) {
         output.type = "xmpp";
         match = url.match(/xmpp:([a-zA-Z0-9\.\-\_]*)@([a-zA-Z0-9\.\-\_]*)(?:\?(.*))?/);
         output.display = `${match[1]}@${match[2]}`;
-        output.proofUrl = `https://xmpp-vcard.keyoxide.org/api/vcard/${output.display}/DESC`;
+        output.proofUrl = `https://PLACEHOLDER__XMPP_VCARD_SERVER_DOMAIN/api/vcard/${output.display}/DESC`;
         output.qr = url;
 
         try {
diff --git a/template.env b/template.env
index be682de..cfc62f2 100644
--- a/template.env
+++ b/template.env
@@ -1,3 +1,8 @@
+# Domain for XMPP vCard fetch server
+# Code for the server can be found here https://codeberg.org/keyoxide/node-xmpp-vcard
+# Defaults to: "xmpp-vcard.keyoxide.org"
+#XMPP_VCARD_SERVER_DOMAIN=
+
 # Twitter API bearer code
 # Documentation: https://developer.twitter.com/en/docs/basics/authentication/oauth-2-0
 # Expected format: "XXXXXXXXXXXXXXXXXXXXX"
diff --git a/views/profile.pug b/views/profile.pug
index ca42316..b7eab45 100644
--- a/views/profile.pug
+++ b/views/profile.pug
@@ -22,4 +22,4 @@ main.container.container--profile
       | .
 
 script(src='/static/openpgp.min.js')
-script(type='text/javascript' src='/static/scripts.js' charset='utf-8')
+script(type='application/javascript' src='/static/scripts.js' charset='utf-8')
diff --git a/views/template.base.pug b/views/template.base.pug
index c6d2ec9..2008540 100644
--- a/views/template.base.pug
+++ b/views/template.base.pug
@@ -30,4 +30,4 @@ main.container
 
 script(src='/static/openpgp.min.js')
 script(src='/static/qrcode.min.js')
-script(type='text/javascript' src='/static/scripts.js' charset='utf-8')
+script(type='application/javascript' src='/static/scripts.js' charset='utf-8')