diff --git a/src/main.go b/src/main.go
index 1d406b5..58288e5 100644
--- a/src/main.go
+++ b/src/main.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"log/slog"
 	"net/http"
+	"net/http/httputil"
 	"net/url"
 	"os"
 	"os/signal"
@@ -107,6 +108,23 @@ func main() {
 	// Setup HTTP router
 	mux := http.NewServeMux()
 
+	// Reverse proxy: /auth/* → Authelia (except /auth/callback)
+	autheliaProxy := httputil.NewSingleHostReverseProxy(&url.URL{
+		Scheme: "http",
+		Host:   fmt.Sprintf("%s:%d", "127.0.0.1", 9091),
+	})
+	mux.HandleFunc("GET /auth/", func(w http.ResponseWriter, r *http.Request) {
+		// Skip /auth/callback and /auth/login /auth/logout — handled by NextWks
+		if r.URL.Path == "/auth/callback" || r.URL.Path == "/auth/login" || r.URL.Path == "/auth/logout" {
+			http.NotFound(w, r)
+			return
+		}
+		autheliaProxy.ServeHTTP(w, r)
+	})
+	mux.HandleFunc("POST /auth/", func(w http.ResponseWriter, r *http.Request) {
+		autheliaProxy.ServeHTTP(w, r)
+	})
+
 	// --- Public endpoints ---
 	mux.HandleFunc("GET /api/health", func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")