diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 0a283d0d3a..998c232e11 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-a28f3509d0aa7c0e17fa6dcb1d03d935a7a2a11c
+2c2b8dc99689f54b8cd916fb9472fd5698b09478
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index a3505eaac9..989fe58c77 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -2447,6 +2447,9 @@ paths:
                     type: string
                   client_id:
                     type: string
+                  app_owner:
+                    type: string
+                    nullable: true
                 required:
                   - base_url
                   - app_slug
diff --git a/frontend/src/lib/components/instanceSettings/GhesAppSettings.svelte b/frontend/src/lib/components/instanceSettings/GhesAppSettings.svelte
index 3d6c314812..e94e56be0c 100644
--- a/frontend/src/lib/components/instanceSettings/GhesAppSettings.svelte
+++ b/frontend/src/lib/components/instanceSettings/GhesAppSettings.svelte
@@ -152,6 +152,23 @@
 				bind:value={$values['github_enterprise_app'].client_id}
 			/>
 		</div>
+		<div class="flex flex-col gap-1">
+			<label for="ghes_app_owner" class="block text-xs font-semibold text-emphasis mb-1">
+				App owner
+			</label>
+			<TextInput
+				inputProps={{
+					type: 'text',
+					id: 'ghes_app_owner',
+					placeholder: 'my-org',
+					disabled: fieldsDisabled
+				}}
+				bind:value={$values['github_enterprise_app'].app_owner}
+			/>
+			<span class="text-2xs text-secondary">
+				Organization or user that owns the GitHub App. Required for GHE Cloud (*.ghe.com) domains.
+			</span>
+		</div>
 	</div>
 
 	<div class="flex flex-col gap-1">
diff --git a/frontend/src/lib/githubApp.ts b/frontend/src/lib/githubApp.ts
index 2f6ec1c1de..be82fb3940 100644
--- a/frontend/src/lib/githubApp.ts
+++ b/frontend/src/lib/githubApp.ts
@@ -142,7 +142,12 @@ export async function loadGithubInstallations(
 				const hostname = new URL(ghesBaseUrl).hostname
 				const isGHES = hostname !== 'github.com' && !hostname.endsWith('.ghe.com')
 				const appsPath = isGHES ? 'github-apps' : 'apps'
-				state.githubInstallationUrl = `${ghesBaseUrl}/${appsPath}/${ghesConfig.app_slug}/installations/new?state=${stateParam}`
+				// GHE Cloud (*.ghe.com) requires the app owner (org/user) in the URL path
+				const appPath =
+					hostname.endsWith('.ghe.com') && ghesConfig.app_owner
+						? `${ghesConfig.app_owner}/${ghesConfig.app_slug}`
+						: ghesConfig.app_slug
+				state.githubInstallationUrl = `${ghesBaseUrl}/${appsPath}/${appPath}/installations/new?state=${stateParam}`
 			} else {
 				state.githubInstallationUrl = `https://github.com/apps/windmill-sync-helper/installations/new?state=${stateParam}`
 			}