diff --git a/Caddyfile b/Caddyfile
index 1cfae4f..0f714f0 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -288,9 +288,11 @@ seanime.hubris.network {
 	reverse_proxy 192.168.8.248:43211
 }
 
-# ─── Oikos (Go rewrite, Docker on mac-mini :8090) ───
+# ─── Oikos (Go rewrite, Docker on mac-mini) ───
 # Phase 6 cutover — replaces apps/105 Python MCP + console.
 # /api/v1/clients/enroll bypasses Authentik (IP-gated in the API handler).
+# The SPA is its own container (:8091, compose/web/Dockerfile in the oikos
+# repo) — not served by api itself, which no longer embeds it.
 oikos.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
@@ -299,9 +301,13 @@ oikos.hubris.network {
 	handle @enroll {
 		reverse_proxy 192.168.178.182:8090
 	}
+	@api path /api/v1/* /mcp /agent/*
+	handle @api {
+		reverse_proxy 192.168.178.182:8090
+	}
 	handle {
 		import authentik
-		reverse_proxy 192.168.178.182:8090
+		reverse_proxy 192.168.178.182:8091
 	}
 }