diff --git a/Caddyfile b/Caddyfile
index bbacd27..8989b84 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -152,8 +152,16 @@ photos.hubris.network {
 	# PhotoPrism API + OIDC callback first (matched before static catch-all)
 	@pp path /api/v1/* /api/v1 /static/* /share/*
 	reverse_proxy @pp 192.168.8.136:2342
-	# PhotoPrism redirects to /library/browse after OIDC. Bounce back to
-	# the SvelteKit SPA; mule-image is the only user-facing frontend.
+	# PhotoPrism's OIDC initiation lives at /library/login (and the
+	# JS posts to /library/login/* during the Authentik handshake).
+	# Proxy those through to PhotoPrism BEFORE the /library/* catch-all
+	# redir, otherwise the user clicks "Sign in with Authentik" and
+	# caddy bounces them straight back to the SvelteKit root.
+	@pp_login path /library/login /library/login/*
+	reverse_proxy @pp_login 192.168.8.136:2342
+	# Everything else under /library/* (notably /library/browse, which
+	# PhotoPrism redirects to after a successful login) bounces back
+	# to the SvelteKit SPA — mule-image is the only user-facing frontend.
 	redir /library /  302
 	redir /library/* / 302
 	# mule-sidecar (Go) — keeps the /api/sidecar/ prefix