diff --git a/Caddyfile b/Caddyfile
index da85814..e706f0f 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -305,26 +305,27 @@ seanime.hubris.network {
 	reverse_proxy 192.168.8.248:43211
 }
 
+# ─── Oikos (Go rewrite, Docker on mac-mini :8090) ───
+# Phase 6 cutover — replaces apps/105 Python MCP + console.
+# /api/v1/clients/enroll bypasses Authentik (IP-gated in the API handler).
 oikos.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
+	@enroll path /api/v1/clients/enroll
+	handle @enroll {
+		reverse_proxy 192.168.178.182:8090
+	}
 	handle {
 		import authentik
-		reverse_proxy 192.168.8.205:8091
+		reverse_proxy 192.168.178.182:8090
 	}
 }
 
-# ─── Oikos (Go rewrite, Docker on mac-mini :8090/:8092) ───
-# Phase 6 cutover — replaces apps/105 Python MCP + console.
-oikos.hubris.network {
-    reverse_proxy 192.168.178.182:8090
-}
-
 mcp.hubris.network {
-    reverse_proxy 192.168.178.182:8090
+	reverse_proxy 192.168.178.182:8090
 }
 
 hermes.hubris.network {
-    reverse_proxy 192.168.178.182:8092
+	reverse_proxy 192.168.178.182:8092
 }