diff --git a/auth.js b/auth.js
index 4b55b33..dd96c74 100644
--- a/auth.js
+++ b/auth.js
@@ -52,10 +52,12 @@ router.get("/auth/callback", async (req, res) => {
     try {
       const locResp = await axios.post(
         `https://${shop}/admin/api/${process.env.SHOPIFY_API_VERSION || "2025-10"}/graphql.json`,
-        { query: "{ locations(first: 1) { nodes { id name } } }" },
+        { query: '{ locations(first: 10, includeInactive: false) { nodes { id name fulfillsOnlineOrders } } }' },
         { headers: { "X-Shopify-Access-Token": access_token, "Content-Type": "application/json" } }
       );
-      const node = locResp.data?.data?.locations?.nodes?.[0];
+      const nodes = locResp.data?.data?.locations?.nodes || [];
+      // Prefer the location that fulfills online orders (the real shop location)
+      const node = nodes.find((l) => l.fulfillsOnlineOrders) || nodes[0];
       if (node?.id) {
         saveToken(shop, access_token, scope, null, node.id);
         log(shop, `Primary location saved: ${node.name} (${node.id})`);