diff --git a/src/main.go b/src/main.go
index ad0b181..6cc9890 100644
--- a/src/main.go
+++ b/src/main.go
@@ -122,11 +122,13 @@ func main() {
 	}
 	uiHandler.RegisterRoutes(mux, combinedAuth)
 
-	// --- Admin routes (protected by bearer token) ---
+	// --- Admin API routes (JSON, protected by bearer token) ---
 	adminAuth := admin.TokenAuthMiddleware(cfg.Admin.SecretToken)
 	adminHandler.RegisterRoutes(mux, adminAuth)
-	adminHandler.RegisterUIRoutes(mux, adminAuth)
-	adminHandler.RegisterHTMXRoutes(mux, adminAuth)
+
+	// --- Admin UI routes (Templ-rendered HTML, protected by OIDC session) ---
+	adminHandler.RegisterUIRoutes(mux, combinedAuth)
+	adminHandler.RegisterHTMXRoutes(mux, combinedAuth)
 
 	// --- OIDC config page — shows Authelia status ---
 	mux.HandleFunc("GET /auth/status", func(w http.ResponseWriter, r *http.Request) {