diff --git a/oci.go b/oci.go
index 4ee95a4..77508ff 100644
--- a/oci.go
+++ b/oci.go
@@ -81,9 +81,11 @@ func NewOCI(conf *OCIConfig) (Storage, error) {
 		client.HTTPClient = c
 	}
 
-	// The SDK only prepends a scheme to client.Host on the first request, so
-	// read it before GetNamespace below.
-	host := strings.TrimPrefix(client.Host, "https://")
+	// client.Host keeps endpoint options such as {dualStack?ds.oci.:}, which the
+	// SDK resolves on a copy per request, so resolve them the same way here.
+	resolved := client.BaseClient
+	common.UpdateEndpointTemplateForOptions(&resolved)
+	host := strings.TrimPrefix(resolved.Host, "https://")
 	insecure := strings.HasPrefix(host, "http://")
 	host = strings.TrimPrefix(host, "http://")
 
diff --git a/oci_test.go b/oci_test.go
index b08b427..0d3d4c6 100644
--- a/oci_test.go
+++ b/oci_test.go
@@ -15,6 +15,11 @@
 package storage
 
 import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/pem"
+	"net/url"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -63,3 +68,25 @@ func TestNewConfigProvider(t *testing.T) {
 		require.NotNil(t, provider)
 	})
 }
+
+func TestOCILocationHost(t *testing.T) {
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+	pemKey := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)})
+
+	// A set Namespace keeps NewOCI off the network.
+	s, err := NewOCI(&OCIConfig{
+		TenancyOCID: "ocid1.tenancy.oc1..tenancy",
+		UserOCID:    "ocid1.user.oc1..user",
+		Fingerprint: "aa:bb:cc",
+		PrivateKey:  string(pemKey),
+		Region:      "us-chicago-1",
+		Namespace:   "ns",
+		Bucket:      "bucket",
+	})
+	require.NoError(t, err)
+
+	u, err := url.Parse(s.(*ociStorage).location("a/b.mp4"))
+	require.NoError(t, err)
+	require.Equal(t, "objectstorage.us-chicago-1.oraclecloud.com", u.Host)
+}