Web app with set hostname and redirects to internal hostnames

I’m trying to tunnel a web application running on-prem, it works fine. But it has built-in redirects to an internal hostname which is not resolvable from the internet (webapp.company.lan). The configured hostname in Cloudflare Tunnel is webapp.company.com, and the application will do redirects to webapp.company.lan. We can’t change how the web app works.

How do I handle this?

Build an internal proxy using nginx or similar which you point webapp.company.com to at the Cloudflare Tunnel target which rewrites the host header sent to the actual application of webapp.company.lan