diff --git a/PROJECTS/beginner/canary-token-generator/backend/cmd/canary/main.go b/PROJECTS/beginner/canary-token-generator/backend/cmd/canary/main.go
index 04cd79c4..f91a06c2 100644
--- a/PROJECTS/beginner/canary-token-generator/backend/cmd/canary/main.go
+++ b/PROJECTS/beginner/canary-token-generator/backend/cmd/canary/main.go
@@ -86,7 +86,11 @@ func run(configPath string) error {
 	}
 	logger.Info("redis connected")
 
-	genRegistry := registry.Build(registry.Config{BaseURL: cfg.Canary.BaseURL})
+	genRegistry := registry.Build(registry.Config{
+		BaseURL:         cfg.Canary.BaseURL,
+		MySQLPublicHost: cfg.MySQL.PublicHost,
+		MySQLPublicPort: cfg.MySQL.PublicPort,
+	})
 	tokenSvc := token.NewService(
 		tokenRepo,
 		registryAdapter{r: genRegistry},
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/registry/registry.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/registry/registry.go
index ee987da6..e4801823 100644
--- a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/registry/registry.go
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/registry/registry.go
@@ -16,12 +16,22 @@ import (
 )
 
 type Config struct {
-	BaseURL string
+	BaseURL         string
+	MySQLPublicHost string
+	MySQLPublicPort int
 }
 
 type Registry map[token.Type]generators.Generator
 
-func Build(_ Config) Registry {
+func Build(cfg Config) Registry {
+	host := cfg.MySQLPublicHost
+	port := cfg.MySQLPublicPort
+	var mysqlGen *mysql.Generator
+	if host == "" || port == 0 {
+		mysqlGen = mysql.New()
+	} else {
+		mysqlGen = mysql.NewWithAddress(host, port)
+	}
 	return Registry{
 		token.TypeWebbug:       webbug.New(),
 		token.TypeSlowRedirect: slowredirect.New(),
@@ -29,6 +39,6 @@ func Build(_ Config) Registry {
 		token.TypePDF:          pdf.New(),
 		token.TypeKubeconfig:   kubeconfig.New(),
 		token.TypeEnvfile:      envfile.New(),
-		token.TypeMySQL:        mysql.New(),
+		token.TypeMySQL:        mysqlGen,
 	}
 }
diff --git a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/registry/registry_test.go b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/registry/registry_test.go
index bc4432d6..84dd1a53 100644
--- a/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/registry/registry_test.go
+++ b/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/registry/registry_test.go
@@ -4,6 +4,7 @@
 package registry_test
 
 import (
+	"context"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -77,6 +78,26 @@ func TestBuild_UnknownTypeReturnsZeroValue(t *testing.T) {
 	require.Nil(t, g, "map zero value for missing key must be nil interface")
 }
 
+func TestBuild_MySQLUsesConfiguredPublicAddress(t *testing.T) {
+	reg := registry.Build(registry.Config{
+		BaseURL:         testBaseURL,
+		MySQLPublicHost: "canary.example.com",
+		MySQLPublicPort: 13306,
+	})
+	g, ok := reg[token.TypeMySQL]
+	require.True(t, ok)
+
+	tok := &token.Token{ID: "abc", Type: token.TypeMySQL}
+	art, err := g.Generate(context.Background(), tok, testBaseURL)
+	require.NoError(t, err)
+	require.Equal(
+		t,
+		"mysql://canary_abc@canary.example.com:13306/internal_db",
+		art.ConnectionString,
+		"mysql connection string must reflect configured public host:port",
+	)
+}
+
 func TestBuild_AllSevenGeneratorsRegistered(t *testing.T) {
 	reg := registry.Build(registry.Config{BaseURL: testBaseURL})
 	require.Len(