diff --git a/sidecar/handlers_ppproxy.go b/sidecar/handlers_ppproxy.go
index 22377de..93cfe13 100644
--- a/sidecar/handlers_ppproxy.go
+++ b/sidecar/handlers_ppproxy.go
@@ -260,10 +260,15 @@ func handlePPProxy(cfg *Config, ppDb *gorm.DB) gin.HandlerFunc {
 		c.Request.URL.RawPath = ""
 		method := c.Request.Method
 
-		// Unauthenticated / token-in-URL surface: login+logout, client
-		// config, hash-addressed media, websocket.
+		// Unauthenticated / token-in-URL surface: login+logout, OIDC
+		// login+callback (PhotoPrism's actual routes are /api/v1/oidc/login
+		// and /api/v1/oidc/redirect — "oauth/" was never a real PhotoPrism
+		// path and left the Authentik callback with no valid token yet
+		// falling through to the authenticated branch below, producing a
+		// 401 "invalid session" before the session was even established),
+		// client config, hash-addressed media, websocket.
 		passUnscoped := rest == "session" || strings.HasPrefix(rest, "session/") ||
-			strings.HasPrefix(rest, "oauth/") ||
+			strings.HasPrefix(rest, "oidc/") ||
 			rest == "config" || rest == "ws" ||
 			strings.HasPrefix(rest, "t/") ||
 			strings.HasPrefix(rest, "dl/") ||