diff --git a/src/routes/login.tsx b/src/routes/login.tsx
index 116924c..5662f74 100644
--- a/src/routes/login.tsx
+++ b/src/routes/login.tsx
@@ -40,10 +40,13 @@ export default function LoginPage() {
   // The employees service (which backs /api/admin/auth/login) requires the
   // same server-side captcha challenge the public site uses — generated by
   // the users service at /api/auth/captcha and verified against shared Redis.
+  // Routed through /api/gateway/* (this app's generic gateway proxy) rather
+  // than a bare /api/auth/* path — there is no server route for that prefix,
+  // so it would otherwise silently fall through to the SPA's index.html.
   const loadCaptcha = async () => {
     setCaptchaInput('');
     try {
-      const r = await fetch('/api/auth/captcha', { method: 'POST', headers: { Accept: 'application/json' }, credentials: 'include' });
+      const r = await fetch('/api/gateway/auth/captcha', { method: 'POST', headers: { Accept: 'application/json' }, credentials: 'include' });
       const payload = await r.json().catch(() => ({}));
       setCaptchaId(String(payload?.captcha_id || ''));
       setCaptchaChallenge(String(payload?.challenge || ''));