diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile
index f5a5cd2..a14d157 100644
--- a/dankclaw/Caddyfile
+++ b/dankclaw/Caddyfile
@@ -54,7 +54,7 @@ dankclaw.franksdank.cloud {
 	basicauth @admin {
 		frank REPLACE_WITH_ADMIN_HASH
 	}
-	@admin rewrite * /admin.html
+	rewrite @admin /admin.html
 	root * /srv/homepage
 	file_server
 }
diff --git a/tests/homepage_caddy.bats b/tests/homepage_caddy.bats
index 50bfe01..0a30ff5 100644
--- a/tests/homepage_caddy.bats
+++ b/tests/homepage_caddy.bats
@@ -26,5 +26,8 @@ setup() {
 }
 
 @test "the /admin/ path is rewritten to admin.html" {
-    grep -qE "@admin[[:space:]]+rewrite[[:space:]]+\*[[:space:]]+/admin.html" "$CADDY"
+    # The matcher token follows the directive (rewrite @admin ...), per the
+    # Caddyfile matcher docs. A leading '@admin rewrite' is parsed as a
+    # one-liner matcher DEFINITION and re-defines @admin (invalid).
+    grep -qE "rewrite[[:space:]]+@admin[[:space:]]+/admin.html" "$CADDY"
 }