diff --git a/Caddyfile b/Caddyfile
index c034a78..793c981 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -161,5 +161,17 @@ artifacto.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
-	reverse_proxy 192.168.8.205:3100
+	# Public paths: share URLs, static assets, health — no SSO
+	@public path /p/* /static/* /healthz
+	handle @public {
+		reverse_proxy 192.168.8.205:3100
+	}
+	# Admin + login surface: Authentik forward-auth + shared-secret header
+	# so the app can auto-login an Authentik-authenticated user.
+	handle {
+		import authentik
+		reverse_proxy 192.168.8.205:3100 {
+			header_up X-Artifacto-Gateway {env.ARTIFACTO_GATEWAY_SECRET}
+		}
+	}
 }