diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile
index 46bf45a..1569963 100644
--- a/dankclaw/Caddyfile
+++ b/dankclaw/Caddyfile
@@ -337,7 +337,7 @@ http://:8017 {
 			try_files /docs.html
 			file_server
 		}
-		@data path /services.json /status.json /app.js /style.css /deployed.js
+		@data path /services.json /status.json /app.js /style.css /deployed.js /img/*
 		handle @data {
 			file_server
 		}
diff --git a/tests/homepage_caddy.bats b/tests/homepage_caddy.bats
index 57e58be..90ad2d5 100644
--- a/tests/homepage_caddy.bats
+++ b/tests/homepage_caddy.bats
@@ -31,6 +31,9 @@ setup() {
     # can access them (the browser's Authentik session covers these fetches).
     grep -qE "@data[[:space:]]+path[[:space:]]+/services\.json[[:space:]]+/status\.json" "$CADDY"
     grep -qE "handle[[:space:]]+@data" "$CADDY"
+    # docs screenshots (/img/*) must be served from disk, not answered by the
+    # index.html catch-all (2026-10-08: PNGs came back as 200 text/html).
+    grep -qE "@data[[:space:]]+path.*(/img/\*|/img/\*\")" "$CADDY"
 }
 
 @test "the homepage revalidates its assets (no stale cache after deploys)" {