diff --git a/Caddyfile b/Caddyfile
index 9b1a898..5a0b832 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -39,7 +39,16 @@ media.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
-	reverse_proxy 192.168.8.206:8096
+	# API and streaming paths — no Authentik (Jellyfin apps use their own auth)
+	@api path /api/* /socket /Audio/* /Videos/* /Items/* /Users/* /Sessions/* /System/* /LiveTv/* /Music/* /Artists/* /Albums/* /Playlists/* /Images/* /Subtitle* /videos/* /audio/*
+	handle @api {
+		reverse_proxy 192.168.8.206:8096
+	}
+	# Web UI — gated behind Authentik
+	handle {
+		import authentik
+		reverse_proxy 192.168.8.206:8096
+	}
 }
 
 git.hubris.network {
@@ -282,9 +291,5 @@ teddy.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
-	reverse_proxy https://192.168.8.243:8443 {
-		transport http {
-			tls_insecure_skip_verify
-		}
-	}
+	reverse_proxy 192.168.8.243:8080
 }