diff --git a/Caddyfile b/Caddyfile
index 6223b3a..c18c0c4 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -1,9 +1,20 @@
+# Internal forward-auth upstream proxy (no TLS between Caddy handlers)
+:8099 {
+	@outpost path /outpost.goauthentik.io/*
+	reverse_proxy @outpost https://auth.hubris.network:443 {
+		transport http {
+			tls_server_name auth.hubris.network
+		}
+		header_up Host auth.hubris.network
+	}
+}
+
 # Authentik forward-auth snippet (domain-level mode).
 # Usage: add "import authentik" inside any site block to gate it.
 (authentik) {
 	route {
 		reverse_proxy /outpost.goauthentik.io/* https://auth.hubris.network:443
-		forward_auth https://auth.hubris.network:443 {
+		forward_auth http://127.0.0.1:8099 {
 			uri /outpost.goauthentik.io/auth/caddy
 			copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
 			trusted_proxies private_ranges