diff --git a/.github/workflows/canister-tests.yml b/.github/workflows/canister-tests.yml
index 4164cd5bfa..98f4d00d20 100644
--- a/.github/workflows/canister-tests.yml
+++ b/.github/workflows/canister-tests.yml
@@ -468,13 +468,11 @@ jobs:
 
       - name: Deploy canisters
         run: |
+          # NOTE: dfx install will run the postinstall scripts from dfx.json
           dfx canister install internet_identity --wasm internet_identity_test.wasm.gz
           dfx canister install test_app --wasm demos/test-app/test_app.wasm
           dfx canister install issuer --wasm demos/vc_issuer/vc_demo_issuer.wasm.gz
 
-      - name: Provision issuer canister
-        run: ./demos/vc_issuer/provision
-
       # Check the return code of npm ci
       - name: Check on npm ci
         # make sure we don't wait too long if for some unlikely reason the npm status file doesn't get created
diff --git a/demos/vc_issuer/app/index.tsx b/demos/vc_issuer/app/index.tsx
index 1df778fe4f..1fb2bd9707 100644
--- a/demos/vc_issuer/app/index.tsx
+++ b/demos/vc_issuer/app/index.tsx
@@ -117,6 +117,16 @@ const App = () => {
           />
         </label>
       </section>
+      <section>
+        <label>
+          Custom principal:
+          <input
+            data-role="custom-principal"
+            type="text"
+            onChange={(evt) => setPrincipal(evt.target.value)}
+          />
+        </label>
+      </section>
       <section>
         <button
           data-action="authenticate"
diff --git a/demos/vc_issuer/provision b/demos/vc_issuer/provision
index 3fb12cce1a..4ddcd104f7 100755
--- a/demos/vc_issuer/provision
+++ b/demos/vc_issuer/provision
@@ -61,12 +61,12 @@ do
             shift;
             ;;
         --issuer-derivation-origin)
-            DERIVATION_ORIGIN="${2:?missing value for '--issuer-derivation-origin'}"
+            ISSUER_DERIVATION_ORIGIN="${2:?missing value for '--issuer-derivation-origin'}"
             shift; # shift past --issuer-canister & value
             shift;
             ;;
         --issuer-frontend-hostname)
-            FRONTEND_HOSTNAME="${2:?missing value for '--issuer-frontend-hostname'}"
+            ISSUER_FRONTEND_HOSTNAME="${2:?missing value for '--issuer-frontend-hostname'}"
             shift; # shift past --issuer-canister & value
             shift;
             ;;
@@ -84,7 +84,7 @@ done
 DFX_NETWORK="${DFX_NETWORK:-local}"
 II_CANISTER_ID="${II_CANISTER_ID:-$(dfx canister id internet_identity)}"
 ISSUER_CANISTER="${ISSUER_CANISTER:-issuer}"
-ISSUER_CANISTER_ID=$(dfx canister id $ISSUER_CANISTER)
+ISSUER_CANISTER_ID=$(dfx canister id "$ISSUER_CANISTER")
 DEFAULT_DERIVATION_ORIGIN="https://$ISSUER_CANISTER_ID.icp0.io"
 ISSUER_DERIVATION_ORIGIN="${ISSUER_DERIVATION_ORIGIN:-$DEFAULT_DERIVATION_ORIGIN}"
 ISSUER_FRONTEND_HOSTNAME="${ISSUER_FRONTEND_HOSTNAME:-$ISSUER_DERIVATION_ORIGIN}"
diff --git a/demos/vc_issuer/src/main.rs b/demos/vc_issuer/src/main.rs
index 59c75cde3a..d983fe760e 100644
--- a/demos/vc_issuer/src/main.rs
+++ b/demos/vc_issuer/src/main.rs
@@ -307,15 +307,16 @@ async fn derivation_origin(
 fn get_derivation_origin(hostname: &str) -> Result<DerivationOriginData, DerivationOriginError> {
     CONFIG.with_borrow(|config| {
         let config = config.get();
-        if hostname == config.frontend_hostname {
-            Ok(DerivationOriginData {
-                origin: config.derivation_origin.clone(),
-            })
-        } else {
-            Err(DerivationOriginError::UnsupportedOrigin(
-                hostname.to_string(),
-            ))
+
+        // We don't currently rely on the value provided, so if it doesn't match
+        // we just print a warning
+        if hostname != config.frontend_hostname {
+            println!("*** achtung! bad frontend hostname {}", hostname,);
         }
+
+        Ok(DerivationOriginData {
+            origin: config.derivation_origin.clone(),
+        })
     })
 }
 
diff --git a/demos/vc_issuer/tests/issue_credential.rs b/demos/vc_issuer/tests/issue_credential.rs
index 67a589e88a..616879cd86 100644
--- a/demos/vc_issuer/tests/issue_credential.rs
+++ b/demos/vc_issuer/tests/issue_credential.rs
@@ -371,23 +371,6 @@ fn should_return_derivation_origin_with_custom_init() {
     assert_eq!(response.origin, custom_init.derivation_origin);
 }
 
-#[test]
-fn should_fail_derivation_origin_if_unsupported_origin() {
-    let env = env();
-    let canister_id = install_canister(&env, VC_ISSUER_WASM.clone());
-    let req = DerivationOriginRequest {
-        frontend_hostname: "https://wrong.fe.host".to_string(),
-    };
-    let response =
-        api::derivation_origin(&env, canister_id, principal_1(), &req).expect("API call failed");
-    assert_eq!(
-        response,
-        Err(DerivationOriginError::UnsupportedOrigin(
-            req.frontend_hostname
-        ))
-    );
-}
-
 fn employee_credential_spec() -> CredentialSpec {
     let mut args = HashMap::new();
     args.insert(
diff --git a/dfx.json b/dfx.json
index bc1f1e4c7e..865065dc3e 100644
--- a/dfx.json
+++ b/dfx.json
@@ -18,7 +18,7 @@
       "candid": "demos/vc_issuer/vc_demo_issuer.did",
       "wasm": "demos/vc_issuer/vc_demo_issuer.wasm.gz",
       "build": "demos/vc_issuer/build.sh",
-      "post_install": "demos/vc_issuer/provision",
+      "post_install": "bash -c 'demos/vc_issuer/provision --issuer-derivation-origin https://$(dfx canister id test_app).icp0.io'",
       "dependencies": [ "internet_identity" ]
     }
   },
diff --git a/src/frontend/src/flows/verifiableCredentials/abortedCredentials.json b/src/frontend/src/flows/verifiableCredentials/abortedCredentials.json
index 5b51ca9eea..610e33c642 100644
--- a/src/frontend/src/flows/verifiableCredentials/abortedCredentials.json
+++ b/src/frontend/src/flows/verifiableCredentials/abortedCredentials.json
@@ -5,6 +5,8 @@
     "aborted_internal_error": "There was an unexpected issue while verifying your credentials. Please retry, and if the problem persist contact support.",
     "aborted_auth_failed_ii": "There was an error authenticating you with your Internet Identity. Aliases were not created.",
     "aborted_auth_failed_issuer": "There was an error authenticating you with the issuer. Make sure you can authenticate with the issuer.",
+    "aborted_invalid_derivation_origin_issuer": "The derivation origin given for the issuer is not valid.",
+    "aborted_derivation_origin_issuer_error": "The issuer produced an error when queried for its derivation origin.",
     "aborted_issuer_api_error": "There was an error requesting credentials with the issuer. The issuer returned an error.",
     "aborted_bad_principal_rp": "The principal provided by the relying party does not match the data Internet Identity has.",
     "aborted_no_canister_id": "Internet Identity could not find the canister for the issuer.",
diff --git a/src/frontend/src/flows/verifiableCredentials/abortedCredentials.ts b/src/frontend/src/flows/verifiableCredentials/abortedCredentials.ts
index a2157dc002..98ddd95987 100644
--- a/src/frontend/src/flows/verifiableCredentials/abortedCredentials.ts
+++ b/src/frontend/src/flows/verifiableCredentials/abortedCredentials.ts
@@ -12,6 +12,8 @@ export type AbortReason =
   | "internal_error"
   | "auth_failed_ii"
   | "auth_failed_issuer"
+  | "derivation_origin_issuer_error"
+  | "invalid_derivation_origin_issuer"
   | "issuer_api_error"
   | "bad_principal_rp"
   | "no_canister_id"
diff --git a/src/frontend/src/flows/verifiableCredentials/index.ts b/src/frontend/src/flows/verifiableCredentials/index.ts
index 0bee3dccf1..638f6a4b7c 100644
--- a/src/frontend/src/flows/verifiableCredentials/index.ts
+++ b/src/frontend/src/flows/verifiableCredentials/index.ts
@@ -91,16 +91,32 @@ const verifyCredentials = async ({
     }
   }
 
-  const validationResult = await withLoader(() =>
+  // Verify that principals may be issued to RP using the specified
+  // derivation origin
+  const validRpDerivationOrigin = await withLoader(() =>
     validateDerivationOrigin(rpOrigin_, rpDerivationOrigin)
   );
-  if (validationResult.result === "invalid") {
+  if (validRpDerivationOrigin.result === "invalid") {
     return abortedCredentials({ reason: "bad_derivation_origin_rp" });
   }
-  validationResult.result satisfies "valid";
+  validRpDerivationOrigin.result satisfies "valid";
   const rpOrigin = rpDerivationOrigin ?? rpOrigin_;
 
   const vcIssuer = new VcIssuer(issuerCanisterId);
+
+  const issuerDerivationOriginResult = await getValidatedIssuerDerivationOrigin(
+    {
+      vcIssuer,
+      issuerOrigin,
+    }
+  );
+
+  if (issuerDerivationOriginResult.kind === "error") {
+    return abortedCredentials({ reason: issuerDerivationOriginResult.err });
+  }
+
+  const issuerDerivationOrigin = issuerDerivationOriginResult.origin;
+
   // XXX: We don't check that the language matches the user's language. We need
   // to figure what to do UX-wise first.
   const consentInfo = await vcIssuer.getConsentMessage({ credentialSpec });
@@ -164,7 +180,7 @@ const verifyCredentials = async ({
 
   const pAliasPending = getAliasCredentials({
     rpOrigin,
-    issuerOrigin,
+    issuerOrigin: issuerDerivationOrigin /* Use the actual derivation origin */,
     authenticatedConnection,
   });
 
@@ -180,7 +196,7 @@ const verifyCredentials = async ({
 
     const issuedCredential = await issueCredential({
       vcIssuer,
-      issuerOrigin,
+      issuerOrigin: issuerDerivationOrigin,
       issuerAliasCredential: pAlias.issuerAliasCredential,
       credentialSpec,
       authenticatedConnection,
@@ -302,6 +318,46 @@ const getAliasCredentials = async ({
   return { ok: { rpAliasCredential, issuerAliasCredential } };
 };
 
+// Looks up and verify the derivation origin to be used by the issuer
+const getValidatedIssuerDerivationOrigin = async ({
+  vcIssuer,
+  issuerOrigin,
+}: {
+  vcIssuer: VcIssuer;
+  issuerOrigin: string;
+}): Promise<
+  | {
+      kind: "error";
+      err:
+        | "derivation_origin_issuer_error"
+        | "invalid_derivation_origin_issuer";
+    }
+  | { kind: "ok"; origin: string }
+> => {
+  const result = await vcIssuer.getDerivationOrigin({ origin: issuerOrigin });
+
+  if (result.kind === "error") {
+    return { kind: "error", err: "derivation_origin_issuer_error" };
+  }
+
+  result.kind satisfies "origin";
+
+  const validDerivationOrigin = await validateDerivationOrigin(
+    issuerOrigin,
+    result.origin
+  );
+  if (validDerivationOrigin.result === "invalid") {
+    console.error(
+      "Invalid derivation origin for issuer",
+      JSON.stringify(validDerivationOrigin)
+    );
+    return { kind: "error", err: "invalid_derivation_origin_issuer" };
+  }
+  validDerivationOrigin.result satisfies "valid";
+
+  return { kind: "ok", origin: result.origin };
+};
+
 // Contact the issuer to issue the credentials
 const issueCredential = async ({
   vcIssuer,
diff --git a/src/frontend/src/flows/verifiableCredentials/vcIssuer.ts b/src/frontend/src/flows/verifiableCredentials/vcIssuer.ts
index ae1675df27..0931f23a93 100644
--- a/src/frontend/src/flows/verifiableCredentials/vcIssuer.ts
+++ b/src/frontend/src/flows/verifiableCredentials/vcIssuer.ts
@@ -54,7 +54,9 @@ export class VcIssuer {
     });
 
     if ("Err" in result) {
-      console.error("Could not prepare credential", result.Err);
+      console.error(
+        "Could not prepare credential: " + JSON.stringify(result.Err)
+      );
       return "error";
     }
 
@@ -107,4 +109,32 @@ export class VcIssuer {
 
     return result.Ok;
   };
+
+  getDerivationOrigin = async ({
+    origin,
+  }: {
+    origin: string;
+  }): Promise<{ kind: "origin"; origin: string } | { kind: "error" }> => {
+    const actor = await this.createActor();
+
+    let result;
+    try {
+      result = await actor.derivation_origin({
+        frontend_hostname: origin,
+      });
+    } catch (e: unknown) {
+      console.error("Could not get derivation origin (unexpected error)", e);
+      return { kind: "error" };
+    }
+
+    if ("Err" in result) {
+      console.error(
+        "Could not get derivation origin (issuer error)",
+        JSON.stringify(result.Err)
+      );
+      return { kind: "error" };
+    }
+
+    return { kind: "origin", origin: result.Ok.origin };
+  };
 }
diff --git a/src/frontend/src/test-e2e/constants.ts b/src/frontend/src/test-e2e/constants.ts
index e82e9ba952..cb6cfb4d1e 100644
--- a/src/frontend/src/test-e2e/constants.ts
+++ b/src/frontend/src/test-e2e/constants.ts
@@ -13,6 +13,9 @@ export const TEST_APP_NICE_URL = "https://nice-name.com";
 export const ISSUER_APP_URL = `https://${issuerAppCanisterId}.icp0.io`;
 export const ISSUER_APP_URL_LEGACY = `https://${issuerAppCanisterId}.ic0.app`;
 
+// Value needs to match how the canister was provisioned
+export const ISSUER_CUSTOM_ORIGIN_NICE_URL = `https://nice-issuer-custom-orig.com`;
+
 export const II_URL =
   process.env.II_URL ?? "https://identity.internetcomputer.org";
 
diff --git a/src/frontend/src/test-e2e/verifiableCredentials/alternativeOrigins.test.ts b/src/frontend/src/test-e2e/verifiableCredentials/alternativeOrigins.test.ts
index 6800d84206..4937a8c3c2 100644
--- a/src/frontend/src/test-e2e/verifiableCredentials/alternativeOrigins.test.ts
+++ b/src/frontend/src/test-e2e/verifiableCredentials/alternativeOrigins.test.ts
@@ -4,6 +4,7 @@ import { DemoAppView } from "$src/test-e2e/views";
 import {
   II_URL,
   ISSUER_APP_URL,
+  ISSUER_CUSTOM_ORIGIN_NICE_URL,
   TEST_APP_CANONICAL_URL,
   TEST_APP_NICE_URL,
 } from "$src/test-e2e/constants";
@@ -22,23 +23,41 @@ test("Can issue credential with alternative RP derivation origin", async () => {
 
     const authConfig = await register["webauthn"](browser);
 
-    // 1. Add employee
+    // XXX: The issuer always specifies a derivation origin, which we need
+    // to whitelist (we use the test app because it's the only canister that
+    // has an API for setting alternative origins)
+    const demoAppView = new DemoAppView(browser);
+    await demoAppView.open(TEST_APP_CANONICAL_URL, II_URL);
+    await demoAppView.updateAlternativeOrigins(
+      `{"alternativeOrigins":["${ISSUER_APP_URL}"]}`,
+      "certified"
+    );
 
-    const { msg: _msg, principal: _principal } = await registerWithIssuer({
+    // Do the flow without alt origins
+
+    let vcTestApp = await authenticateToRelyingParty({
       browser,
       issuer: ISSUER_APP_URL,
       authConfig,
+      relyingParty: TEST_APP_CANONICAL_URL,
     });
+    const principalRP = await vcTestApp.getPrincipal();
 
-    // 2. Do the flow without alt origins
+    // Add employee and set up issuer
+    const { msg: _msg, principal: _principal } = await registerWithIssuer({
+      browser,
+      issuer: ISSUER_APP_URL,
+      authConfig,
+      principal: principalRP,
+    });
 
-    const vcTestApp = await authenticateToRelyingParty({
+    vcTestApp = await authenticateToRelyingParty({
       browser,
       issuer: ISSUER_APP_URL,
       authConfig,
       relyingParty: TEST_APP_CANONICAL_URL,
     });
-    const principalRP = await vcTestApp.getPrincipal();
+
     const { alias: alias_ } = await getVCPresentation({
       vcTestApp,
       browser,
@@ -57,6 +76,12 @@ test("Can issue credential with alternative RP derivation origin", async () => {
     const principalRPAlt = await vcTestAppAlt.getPrincipal();
     expect(principalRPAlt).toBe(principalRP);
 
+    // XXX: More gymnastics for alternative origins to be set correctly during VC flow
+    await demoAppView.updateAlternativeOrigins(
+      `{"alternativeOrigins":["${ISSUER_APP_URL}", "${TEST_APP_NICE_URL}"]}`,
+      "certified"
+    );
+
     const { alias: aliasAlt_ } = await getVCPresentation({
       vcTestApp: vcTestAppAlt,
       browser,
@@ -109,3 +134,60 @@ test("Cannot issue credential with bad alternative RP derivation origin", async
     expect(result.reason).toBe("bad_derivation_origin_rp");
   });
 }, 300_000);
+
+test("Can issue credential with alternative issuer derivation origin", async () => {
+  await runInBrowser(async (browser: WebdriverIO.Browser) => {
+    await browser.url(II_URL);
+
+    // This runs a VC flow where the issuer uses a nice domain and uses the test-app as its
+    // derivation origin. We use the test-app as derivation origin because it is easy
+    // to configure its alternativeOrigins.
+
+    const issuer = ISSUER_CUSTOM_ORIGIN_NICE_URL;
+    const relyingParty = TEST_APP_CANONICAL_URL;
+
+    const authConfig = await register["webauthn"](browser);
+
+    // First authenticate & grab the principal (because of alternative origins, it's the same
+    // for the test app and the issuer)
+    let vcTestApp = await authenticateToRelyingParty({
+      browser,
+      issuer,
+      authConfig,
+      relyingParty,
+    });
+    const principalRP = await vcTestApp.getPrincipal();
+
+    // Register with the issuer, with a custom principal (i.e. not one generated by the issuer's
+    // origin)
+    const { msg: _msg, principal: _principal } = await registerWithIssuer({
+      browser,
+      issuer,
+      principal: principalRP,
+      authConfig,
+    });
+
+    // Go back to the test app and start the VC flow
+
+    // XXX: we use the test app as the derivation origin because it has an
+    // API for updating alternative origins
+    const demoAppView = new DemoAppView(browser);
+    await demoAppView.open(relyingParty, II_URL);
+    await demoAppView.updateAlternativeOrigins(
+      `{"alternativeOrigins":["${issuer}"]}`,
+      "certified"
+    );
+
+    vcTestApp = await authenticateToRelyingParty({
+      browser,
+      issuer,
+      authConfig,
+      relyingParty,
+    });
+    const { alias: _alias } = await getVCPresentation({
+      vcTestApp,
+      browser,
+      authConfig,
+    });
+  });
+}, 300_000);
diff --git a/src/frontend/src/test-e2e/verifiableCredentials/index.test.ts b/src/frontend/src/test-e2e/verifiableCredentials/index.test.ts
index 41213e438b..b7af31710d 100644
--- a/src/frontend/src/test-e2e/verifiableCredentials/index.test.ts
+++ b/src/frontend/src/test-e2e/verifiableCredentials/index.test.ts
@@ -8,6 +8,7 @@ import {
   TEST_APP_CANONICAL_URL,
   TEST_APP_CANONICAL_URL_LEGACY,
 } from "$src/test-e2e/constants";
+import { DemoAppView } from "$src/test-e2e/views";
 
 import {
   authenticateToRelyingParty,
@@ -70,29 +71,41 @@ testConfigs.forEach(({ relyingParty, issuer, authType }) => {
 
           const authConfig = await register[authType](browser);
 
-          // 1. Add employee
+          // Auth to RP
+
+          let vcTestApp = await authenticateToRelyingParty({
+            browser,
+            issuer,
+            authConfig,
+            relyingParty,
+          });
+          const principalRP = await vcTestApp.getPrincipal();
+
+          // Add employee
 
           const { msg: _msg, principal: _principal } = await registerWithIssuer(
             {
               browser,
               issuer,
               authConfig,
+              principal: principalRP /* issuer uses test app as origin */,
             }
           );
 
-          // 2. Auth to RP
+          // Get VC presentation
 
-          const vcTestApp = await authenticateToRelyingParty({
+          vcTestApp = await authenticateToRelyingParty({
             browser,
             issuer,
             authConfig,
             relyingParty,
           });
 
-          const principalRP = await vcTestApp.getPrincipal();
-
-          // 3. Get VC presentation
-
+          const demoAppView = new DemoAppView(browser);
+          await demoAppView.updateAlternativeOrigins(
+            `{"alternativeOrigins":["${issuer}"]}`,
+            "certified"
+          );
           const { alias } = await getVCPresentation({
             vcTestApp,
             browser,
diff --git a/src/frontend/src/test-e2e/verifiableCredentials/utils.ts b/src/frontend/src/test-e2e/verifiableCredentials/utils.ts
index dd8cd8bd2b..cb48aafc9f 100644
--- a/src/frontend/src/test-e2e/verifiableCredentials/utils.ts
+++ b/src/frontend/src/test-e2e/verifiableCredentials/utils.ts
@@ -24,10 +24,12 @@ import { nonNullish } from "@dfinity/utils";
 export const registerWithIssuer = async ({
   browser,
   issuer,
+  principal: principal_,
   authConfig: { setupAuth, finalizeAuth, userNumber },
 }: {
   browser: WebdriverIO.Browser;
   issuer: string;
+  principal?: string;
   authConfig: AuthConfig;
 }): Promise<{ msg: string; principal: string }> => {
   const issuerAppView = new IssuerAppView(browser);
@@ -37,6 +39,13 @@ export const registerWithIssuer = async ({
   });
   await issuerAppView.waitForDisplay();
 
+  if (nonNullish(principal_)) {
+    const principal = principal_;
+    await issuerAppView.setPrincipal({ principal });
+    const msg = await issuerAppView.addEmployee();
+    return { principal, msg };
+  }
+
   expect(await issuerAppView.isAuthenticated()).toBe(false);
 
   await issuerAppView.authenticate();
diff --git a/src/frontend/src/test-e2e/views.ts b/src/frontend/src/test-e2e/views.ts
index a77198deda..2e3eef110e 100644
--- a/src/frontend/src/test-e2e/views.ts
+++ b/src/frontend/src/test-e2e/views.ts
@@ -627,6 +627,14 @@ export class IssuerAppView extends View {
     await iiUrlInput.setValue(iiUrl);
   }
 
+  async setPrincipal({ principal }: { principal: string }): Promise<void> {
+    const principalInput = await this.browser.$(
+      '[data-role="custom-principal"]'
+    );
+    await principalInput.clearValue();
+    await principalInput.setValue(principal);
+  }
+
   async waitForDisplay(): Promise<void> {
     await this.browser
       .$('[data-page="add-employee"]')
diff --git a/src/vc-api/src/generated/vc_issuer_types.ts b/src/vc-api/src/generated/vc_issuer_types.ts
index 4eca0cf983..2741a9ca4e 100644
--- a/src/vc-api/src/generated/vc_issuer_types.ts
+++ b/src/vc-api/src/generated/vc_issuer_types.ts
@@ -8,6 +8,10 @@ export interface CredentialSpec {
   'arguments' : [] | [Array<[string, ArgumentValue]>],
   'credential_type' : string,
 }
+export interface DerivationOriginData { 'origin' : string }
+export type DerivationOriginError = { 'Internal' : string } |
+  { 'UnsupportedOrigin' : string };
+export interface DerivationOriginRequest { 'frontend_hostname' : string }
 export interface GetCredentialRequest {
   'signed_id_alias' : SignedIdAlias,
   'prepared_context' : [] | [Uint8Array | number[]],
@@ -49,8 +53,10 @@ export type IssueCredentialError = { 'Internal' : string } |
   { 'UnsupportedCredentialSpec' : string };
 export interface IssuedCredentialData { 'vc_jws' : string }
 export interface IssuerConfig {
+  'derivation_origin' : string,
   'idp_canister_ids' : Array<Principal>,
   'ic_root_key_der' : Uint8Array | number[],
+  'frontend_hostname' : string,
 }
 export interface PrepareCredentialRequest {
   'signed_id_alias' : SignedIdAlias,
@@ -65,6 +71,11 @@ export interface _SERVICE {
   'add_employee' : ActorMethod<[Principal], string>,
   'add_graduate' : ActorMethod<[Principal], string>,
   'configure' : ActorMethod<[IssuerConfig], undefined>,
+  'derivation_origin' : ActorMethod<
+    [DerivationOriginRequest],
+    { 'Ok' : DerivationOriginData } |
+      { 'Err' : DerivationOriginError }
+  >,
   'get_credential' : ActorMethod<
     [GetCredentialRequest],
     { 'Ok' : IssuedCredentialData } |
@@ -83,3 +94,4 @@ export interface _SERVICE {
   >,
 }
 export declare const idlFactory: IDL.InterfaceFactory;
+export declare const init: (args: { IDL: typeof IDL }) => IDL.Type[];
diff --git a/vite.config.ts b/vite.config.ts
index b633099ba2..45f690ce4b 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -81,6 +81,10 @@ export default defineConfig(({ command, mode }): UserConfig => {
               hosts: ["nice-name.com"],
               canisterName: "test_app",
             },
+            {
+              hosts: ["nice-issuer-custom-orig.com"],
+              canisterName: "issuer",
+            },
             ...(process.env.NO_HOT_RELOAD === "1"
               ? [
                   {