diff --git a/Caddyfile b/Caddyfile
index c034a78..acc8fa0 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -147,7 +147,14 @@ photos.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
-	reverse_proxy 192.168.8.136:3000
+	@api path /api/*
+	handle @api {
+		reverse_proxy 192.168.8.136:3000
+	}
+	handle {
+		import authentik
+		reverse_proxy 192.168.8.136:3000
+	}
 }
 
 auth.hubris.network {
@@ -161,5 +168,14 @@ artifacto.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
-	reverse_proxy 192.168.8.205:3100
+	# Public paths: share URLs, static assets, health — no SSO
+	@public path /p/* /static/* /healthz
+	handle @public {
+		reverse_proxy 192.168.8.205:3100
+	}
+	# Admin + login surface: Authentik forward-auth
+	handle {
+		import authentik
+		reverse_proxy 192.168.8.205:3100
+	}
 }