diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile
index be5e2a3..6445ee9 100644
--- a/dankclaw/Caddyfile
+++ b/dankclaw/Caddyfile
@@ -147,9 +147,11 @@ prometheus.franksdank.cloud {
 	}
 }
 
-# --- Loki ---
+# --- Loki (guarded: Anubis → Authentik; loki-proxy provider, internal_host caddy:8017) ---
 loki.franksdank.cloud {
-	reverse_proxy loki:3100
+	reverse_proxy anubis:8923 {
+		header_up X-Real-Ip {remote_host}
+	}
 }
 
 # --- Pi-hole (quadlet on slirp4netns; published 8083) ---
@@ -295,6 +297,11 @@ http://:8017 {
 		reverse_proxy comfyui:8188
 	}
 
+	@loki host loki.franksdank.cloud
+	handle @loki {
+		reverse_proxy loki:3100
+	}
+
 	@prometheus host prometheus.franksdank.cloud
 	handle @prometheus {
 		reverse_proxy prometheus:9090