diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile
index e2bdbdb..2243ca6 100644
--- a/dankclaw/Caddyfile
+++ b/dankclaw/Caddyfile
@@ -264,6 +264,19 @@ files.franksdank.cloud {
 	}
 }
 
+# --- Audiobookshelf (guarded) ---
+# Anubis → Authentik → app, like romm/files. The container carries
+# ROUTER_BASE_PATH=/audiobookshelf, so this vhost serves the app under that
+# path; the bare root is redirected onto it in the post-auth listener, never
+# pre-auth. Guard state in the IdP: proxy provider `abs-proxy`
+# (external_host https://abs.franksdank.cloud/, internal_host http://caddy:8017,
+# application "Audiobookshelf Guard"), claimed by the embedded outpost.
+abs.franksdank.cloud {
+	reverse_proxy anubis:8923 {
+		header_up X-Real-Ip {remote_host}
+	}
+}
+
 # --- Jellyfin ---
 jelly.franksdank.cloud {
 	reverse_proxy 192.168.0.235:8096
@@ -410,6 +423,15 @@ http://:8017 {
 		reverse_proxy 192.168.0.235:3923
 	}
 
+	@abs host abs.franksdank.cloud
+	handle @abs {
+		# The app answers only under its ROUTER_BASE_PATH; the bare root is a
+		# convenience hop, taken post-auth so nothing reaches the app
+		# pre-authentication.
+		redir / /audiobookshelf/ permanent
+		reverse_proxy 192.168.0.235:8000
+	}
+
 	@prowlarr host prowlarr.franksdank.cloud
 	handle @prowlarr {
 		reverse_proxy 192.168.0.112:9696
diff --git a/dankclaw/pihole/addn-hosts b/dankclaw/pihole/addn-hosts
index 327082d..51abc29 100644
--- a/dankclaw/pihole/addn-hosts
+++ b/dankclaw/pihole/addn-hosts
@@ -26,6 +26,7 @@
 192.168.0.143 romm.franksdank.cloud
 192.168.0.143 files.franksdank.cloud
 192.168.0.143 jelly.franksdank.cloud
+192.168.0.143 abs.franksdank.cloud
 192.168.0.143 radarr.franksdank.cloud
 192.168.0.143 lidarr.franksdank.cloud
 192.168.0.143 readarr.franksdank.cloud