diff --git a/nix/host-modules/swarm-authelia.nix b/nix/host-modules/swarm-authelia.nix
index 6a419cf4..fdae67bf 100644
--- a/nix/host-modules/swarm-authelia.nix
+++ b/nix/host-modules/swarm-authelia.nix
@@ -1078,6 +1078,35 @@ in
             settings = {
               theme = "dark";
               server.address = "tcp://127.0.0.1:${toString cfg.port}";
+
+              # Let a machine present an OAuth2 access token to the same
+              # `auth_request` endpoint browsers use, so a scraper can be
+              # authenticated by the gateway instead of every service
+              # growing its own static bearer.
+              #
+              # ⚠️ `authn_strategies` REPLACES the defaults rather than
+              # adding to them, so `CookieSession` is listed explicitly.
+              # Dropping it does not fail to evaluate and does not fail to
+              # start — it silently ends every operator session on the
+              # swarm UI, which rides this same endpoint.
+              #
+              # Unconditional, and not keyed to whichever service is
+              # currently scraped: this only makes a *scheme* available.
+              # Authorisation is the audience — authelia refuses a token
+              # that carries no audience for the requested URL, and a
+              # client may only be issued audiences it is registered for.
+              # So enabling the scheme grants nobody anything until a
+              # client is registered for a specific URL.
+              server.endpoints.authz.auth-request = {
+                implementation = "AuthRequest";
+                authn_strategies = [
+                  {
+                    name = "HeaderAuthorization";
+                    schemes = [ "Bearer" ];
+                  }
+                  { name = "CookieSession"; }
+                ];
+              };
               log.level = "info";
 
               # `watch` is load-bearing, not a convenience: authelia reads