diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile
index fc6ca9c..f5a5cd2 100644
--- a/dankclaw/Caddyfile
+++ b/dankclaw/Caddyfile
@@ -54,6 +54,7 @@ dankclaw.franksdank.cloud {
 	basicauth @admin {
 		frank REPLACE_WITH_ADMIN_HASH
 	}
+	@admin rewrite * /admin.html
 	root * /srv/homepage
 	file_server
 }
diff --git a/scripts/homepage-status.py b/scripts/homepage-status.py
index 0bfdd87..4b913f5 100755
--- a/scripts/homepage-status.py
+++ b/scripts/homepage-status.py
@@ -71,6 +71,7 @@ def main(argv):
         with os.fdopen(fd, "w") as f:
             json.dump(doc, f)
         os.replace(tmp, out_path)
+        os.chmod(out_path, 0o644)  # world-readable so Caddy can serve it
     except Exception:
         if os.path.exists(tmp):
             os.unlink(tmp)
diff --git a/shared/homepage/admin.html b/shared/homepage/admin.html
index 7ff7f00..5c61bfb 100644
--- a/shared/homepage/admin.html
+++ b/shared/homepage/admin.html
@@ -4,6 +4,7 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>frank — admin</title>
+<base href="/">
 <link rel="stylesheet" href="style.css">
 </head>
 <body>
diff --git a/shared/homepage/index.html b/shared/homepage/index.html
index 1cf55a6..f6d2c83 100644
--- a/shared/homepage/index.html
+++ b/shared/homepage/index.html
@@ -4,6 +4,7 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>frank — services</title>
+<base href="/">
 <link rel="stylesheet" href="style.css">
 </head>
 <body>
diff --git a/tests/homepage_caddy.bats b/tests/homepage_caddy.bats
index fb39d1f..50bfe01 100644
--- a/tests/homepage_caddy.bats
+++ b/tests/homepage_caddy.bats
@@ -24,3 +24,7 @@ setup() {
     grep -q "root \* /srv/homepage" "$CADDY"
     grep -q "file_server" "$CADDY"
 }
+
+@test "the /admin/ path is rewritten to admin.html" {
+    grep -qE "@admin[[:space:]]+rewrite[[:space:]]+\*[[:space:]]+/admin.html" "$CADDY"
+}
diff --git a/tests/homepage_checker.bats b/tests/homepage_checker.bats
index cc461fb..d26c84e 100644
--- a/tests/homepage_checker.bats
+++ b/tests/homepage_checker.bats
@@ -88,3 +88,10 @@ assert s["realhttp"] == "up", s
 PY
     kill "$RAW_PID" "$HTTP_PID" 2>/dev/null
 }
+
+@test "the checker writes status.json world-readable so Caddy can serve it" {
+    local svc="$TMP/services.json" out="$TMP/status.json"
+    echo '[{"name":"x","category":"user","probe":"127.0.0.1:1","method":"tcp","wip":true}]' > "$svc"
+    python3 "$CHECKER" "$svc" "$out"
+    [ "$(stat -c %a "$out")" = "644" ]
+}
diff --git a/tests/homepage_pages.bats b/tests/homepage_pages.bats
index d34ca21..a6772f7 100644
--- a/tests/homepage_pages.bats
+++ b/tests/homepage_pages.bats
@@ -43,3 +43,8 @@ setup() {
     grep -q "deployed-at" "$BASE/admin.html"
     grep -q "deployed-at" "$BASE/app.js"
 }
+
+@test "the pages set a base so the /admin/ page resolves refs to the root" {
+    grep -q '<base href="/">' "$BASE/index.html"
+    grep -q '<base href="/">' "$BASE/admin.html"
+}