diff --git a/nix/host-modules/swarm-authelia.nix b/nix/host-modules/swarm-authelia.nix
index 86d844f8..dfbb51ab 100644
--- a/nix/host-modules/swarm-authelia.nix
+++ b/nix/host-modules/swarm-authelia.nix
@@ -1073,6 +1073,41 @@ in
           default_type text/html;
         '';
       };
+
+      # Authelia's MACHINE surface, routed without the error interception
+      # above. A longer prefix wins over `/` in nginx, and
+      # `proxy_intercept_errors` / `error_page` are set inside that
+      # location rather than at server level, so they do not reach here.
+      #
+      # ⚠️ THIS IS A SECURITY BOUNDARY, not a tidy-up. `error_page … =
+      # /__hive_sso_unavailable` takes its status from the redirected
+      # location, which serves a FILE — so it answers **200**. Every
+      # machine caller then receives a success carrying an HTML body
+      # instead of the 502 that actually happened:
+      #
+      #   - `/api/authz/auth-request` — nginx `auth_request` treats any
+      #     2xx as success, so a down authelia would mean ACCESS GRANTED
+      #   - `/api/oidc/introspection` — a token check answering 200
+      #   - `/api/oidc/token`, `/.well-known/openid-configuration` — a
+      #     client parsing an error page as its JSON document
+      #
+      # Measured with both controls rather than reasoned: against a dead
+      # upstream a subrequest through `/` serves the protected content,
+      # and through this prefix it denies, matching a direct dial. The
+      # browser arm confirms `/` still serves the friendly page — a fix
+      # that silently deleted it would pass the deny check alone.
+      #
+      # The split is by AUDIENCE, not by path list: a human typing the
+      # URL gets a page explaining that SSO is down, and every `/api/`
+      # and `/.well-known/` caller — including the login page's own XHR —
+      # gets the status. Enumerating individual endpoints would leave the
+      # next one added silently intercepted.
+      locations."/api/" = {
+        proxyPass = "http://127.0.0.1:${toString cfg.port}";
+      };
+      locations."/.well-known/" = {
+        proxyPass = "http://127.0.0.1:${toString cfg.port}";
+      };
     };
 
     # Order the container after the host CA generator, so the bind source