diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile
index 3cc0532..db177da 100644
--- a/dankclaw/Caddyfile
+++ b/dankclaw/Caddyfile
@@ -242,59 +242,45 @@ qbittorrent.franksdank.cloud {
 # and app are answering); unauthenticated clients get the login flow served
 # in place, authenticated traffic is forwarded back to http://:8017 and
 # routed straight to the app. Exempt vhosts never enter this block.
+# --- Internal listener: auth decision layer ---------------------------------
+# Anubis dials http://caddy:8016 after verifying a client (TARGET in
+# dankclaw/anubis/quadlet/anubis.container). Host headers survive the hop, so
+# per-vhost routing resumes here. This 2026.x build does not mount the outpost
+# URL space for proxy-provider meta-header routing (probed live: /ping answers
+# 204, every app path with meta headers 404s), so guarded vhosts route
+# whole-request to Authentik's flow endpoint instead: unauthenticated clients
+# get the login flow served in place; authenticated sessions complete instantly
+# and bounce back via next= straight to the app at http://:8017. Exempt vhosts
+# never enter this block.
 http://:8016 {
 	@home host www.franksdank.cloud
 	handle @home {
-		reverse_proxy authentik-server:9000 {
-			header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217
-			header_up X-authentik-meta-provider 1
-			header_up X-authentik-meta-app name=caddy
-		}
+		redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://www.franksdank.cloud/ 302
 	}
 
 	@search host search.franksdank.cloud
 	handle @search {
-		reverse_proxy authentik-server:9000 {
-			header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217
-			header_up X-authentik-meta-provider 1
-			header_up X-authentik-meta-app name=caddy
-		}
+		redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://search.franksdank.cloud/ 302
 	}
 
 	@hermes host hermes.franksdank.cloud
 	handle @hermes {
-		reverse_proxy authentik-server:9000 {
-			header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217
-			header_up X-authentik-meta-provider 1
-			header_up X-authentik-meta-app name=caddy
-		}
+		redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://hermes.franksdank.cloud/ 302
 	}
 
 	@prometheus host prometheus.franksdank.cloud
 	handle @prometheus {
-		reverse_proxy authentik-server:9000 {
-			header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217
-			header_up X-authentik-meta-provider 1
-			header_up X-authentik-meta-app name=caddy
-		}
+		redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://prometheus.franksdank.cloud/ 302
 	}
 
 	@romm host romm.franksdank.cloud
 	handle @romm {
-		reverse_proxy authentik-server:9000 {
-			header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217
-			header_up X-authentik-meta-provider 1
-			header_up X-authentik-meta-app name=caddy
-		}
+		redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://romm.franksdank.cloud/ 302
 	}
 
 	@files host files.franksdank.cloud
 	handle @files {
-		reverse_proxy authentik-server:9000 {
-			header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217
-			header_up X-authentik-meta-provider 1
-			header_up X-authentik-meta-app name=caddy
-		}
+		redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://files.franksdank.cloud/ 302
 	}
 }