diff --git a/src/main.go b/src/main.go
index 11426ab..18644a6 100644
--- a/src/main.go
+++ b/src/main.go
@@ -198,15 +198,18 @@ func main() {
 	})
 
 	// --- Proxy routes (all traffic through proxy as catch-all) ---
-	// Launcher dashboard (auth-gated)
-	launcherHandler := combinedAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	// Launcher dashboard: auth only for exact "/", unmatched paths get NotFoundHandler
+	launcherHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path != "/" {
-			// Not the root path — let proxy's NotFoundHandler handle it
+			// Not the root path — let proxy's NotFoundHandler handle it (no auth needed)
 			prx.NotFoundHandler.ServeHTTP(w, r)
 			return
 		}
-		uiHandler.ServeHTTP(w, r)
-	}))
+		// Only apply auth for the actual dashboard root
+		combinedAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			uiHandler.ServeHTTP(w, r)
+		})).ServeHTTP(w, r)
+	})
 
 	// Admin routes use a sub-mux with no-op auth (auth is applied at proxy route level)
 	adminMux := http.NewServeMux()