diff --git a/Caddyfile b/Caddyfile
index 8a18120..a127ffc 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -157,7 +157,7 @@ photos.hubris.network {
 	# then `window.location.href = "/library/login"` to hand off. Bounce
 	# every /library/* request back to the SvelteKit root; the SPA reads
 	# the localStorage session via bootstrapSessionFromPhotoPrism().
-	redir /library /  302
+	redir /library / 302
 	redir /library/* / 302
 	# mule-sidecar (Go) — keeps the /api/sidecar/ prefix
 	@sc path /api/sidecar/*
@@ -170,7 +170,12 @@ auth.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
-	reverse_proxy 192.168.8.6:9000
+	reverse_proxy https://auth.hubris.network:443 {
+		transport http {
+			tls_server_name auth.hubris.network
+		}
+		header_up Host auth.hubris.network
+	}
 }
 
 artifacto.hubris.network {
@@ -230,4 +235,10 @@ sso.hubris.network {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
 	reverse_proxy 192.168.8.6:9000
+	reverse_proxy 192.168.8.6:9000
+	reverse_proxy 82.165.190.79:443 {
+		transport http {
+			tls_server_name auth.hubris.network
+		}
+	}
 }