diff --git a/src/main.go b/src/main.go
index d2448f5..ad0b181 100644
--- a/src/main.go
+++ b/src/main.go
@@ -116,10 +116,11 @@ func main() {
 	})
 
 	// --- Workspace launcher (public, but OIDC-protected) ---
-	sessionMiddleware := sessionStore.SessionMiddleware
-	authGate := oidcHandler.AuthGateMiddleware
-	uiHandler.RegisterRoutes(mux, authGate)
-	_ = sessionMiddleware // Used for session-aware middleware in future
+	// Chain: SessionMiddleware (reads cookie → sets context) → AuthGate (checks context → redirects if needed)
+	combinedAuth := func(next http.Handler) http.Handler {
+		return sessionStore.SessionMiddleware(oidcHandler.AuthGateMiddleware(next))
+	}
+	uiHandler.RegisterRoutes(mux, combinedAuth)
 
 	// --- Admin routes (protected by bearer token) ---
 	adminAuth := admin.TokenAuthMiddleware(cfg.Admin.SecretToken)