diff --git a/nix/host-modules/swarm-victorialogs.nix b/nix/host-modules/swarm-victorialogs.nix
index ca91ea12..9224c314 100644
--- a/nix/host-modules/swarm-victorialogs.nix
+++ b/nix/host-modules/swarm-victorialogs.nix
@@ -24,6 +24,10 @@
 # ⚠️ That ingest location deliberately does not carry `swarmAuthRequest` — a
 # pusher handed its `error_page 401 =302` follows the redirect and POSTs at a
 # login page, which answers 200. See the location itself.
+#
+# The query API has a machine route of the same shape at `^~ /select/logsql/`,
+# for the same reason, and with no filtering of what an authenticated caller
+# may read — see that location.
 {
   pkgs,
   lib,
@@ -202,6 +206,37 @@ in
               auth_request /__hive_authelia;
             '';
           };
+
+          # The read side of that same split: the route a caller holding a
+          # bearer token queries, as opposed to the `/` above which is the
+          # operator's browser. Bare `auth_request` for the ingest route's
+          # exact reason — `error_page 401 =302` hands an unauthenticated
+          # machine caller authelia's login page as a **200 with an HTML
+          # body**, so a client that reads the status code records a
+          # successful query that returned no rows. 401 is the only answer
+          # here that a caller cannot mistake for an empty result.
+          #
+          # `^~` so it outranks the `/` catch-all and stays ahead of any
+          # regex location a later change adds. The prefix is the whole
+          # LogsQL query API and nothing else — `query`, `tail`, `hits`,
+          # `facets`, the `stats_query*` and the `field_*`/`stream_*`
+          # routes — while the browser UI sits beside it under
+          # `/select/vmui`. Both read off the pinned build, not the docs.
+          #
+          # The query is forwarded unmodified — no scoping parameter is
+          # injected, so any authenticated caller reads the whole swarm's
+          # logs. That is the rule in force, not an omission: read
+          # permissions are a later thing, and this location is where one
+          # attaches when it exists.
+          "^~ /select/logsql/" = {
+            # No URI part, so the request path and its query string reach
+            # the store as the caller sent them.
+            proxyPass = "http://127.0.0.1:${toString cfg.port}";
+            extraConfig = ''
+              auth_request /__hive_authelia;
+            '';
+          };
+
           # The subrequest itself — same target, same header set, same
           # reasoning as `swarm-ui.nix`'s own copy (measured against the
           # pinned authelia binary, not copied from an example).