diff --git a/compose/caddy/Caddyfile.oikos b/compose/caddy/Caddyfile.oikos
index 657044e..5947fc4 100644
--- a/compose/caddy/Caddyfile.oikos
+++ b/compose/caddy/Caddyfile.oikos
@@ -2,21 +2,26 @@
 # Lives in dtoro/caddy-conf repo; auto-deploys to caddy (LXC 121).
 # Replaces the old MCP server on apps/105 with the Docker stack on mac-mini.
 
-# Oikos REST API (operator)
+# Oikos REST API (operator) — enrollment endpoint bypasses Authentik
 oikos.hubris.network {
-    reverse_proxy <mac-mini-mesh-ip>:8090
+    tls {
+        dns ionos {env.IONOS_AUTH_API_TOKEN}
+    }
+    @enroll path /api/v1/clients/enroll
+    handle @enroll {
+        reverse_proxy <mac-mini-mesh-ip>:8090
+    }
+    handle {
+        import authentik
+        reverse_proxy <mac-mini-mesh-ip>:8090
+    }
 }
 
-# Oikos MCP endpoint (Hermes agents)
+# Oikos MCP endpoint (Hermes agents) — no auth required
 mcp.hubris.network {
     reverse_proxy <mac-mini-mesh-ip>:8090
 }
 
-# Oikos API (legacy apps/105 path — redirect or proxy during cutover)
-apis.hubris.network {
-    reverse_proxy <mac-mini-mesh-ip>:8090
-}
-
 # Hermes gateway (workstation access)
 hermes.hubris.network {
     reverse_proxy <mac-mini-mesh-ip>:8092