diff --git a/src/lib/job-seeker-custom-data.ts b/src/lib/job-seeker-custom-data.ts
index 0119efa..32d0b32 100644
--- a/src/lib/job-seeker-custom-data.ts
+++ b/src/lib/job-seeker-custom-data.ts
@@ -1,5 +1,3 @@
-const API = '/api/gateway';
-
 export type JobSeekerProfile = {
   id: string;
   user_id: string;
@@ -14,12 +12,26 @@ export type JobSeekerProfile = {
   custom_data?: Record<string, unknown> | null;
 };
 
+// The K8s ingress routes any /api/* path directly to the Rust gateway service —
+// there is no /api/gateway indirection in production (see ~/lib/api.ts). Hit
+// the path as-is, and send the same Authorization bearer token every other
+// authenticated call uses — AuthUser on the backend only reads that header,
+// there is no cookie-based fallback.
+function getAuthHeaders(): Record<string, string> {
+  const token = typeof window !== 'undefined'
+    ? (sessionStorage.getItem('nxtgauge_access_token') || '')
+    : '';
+  return {
+    'Content-Type': 'application/json',
+    ...(token ? { Authorization: `Bearer ${token}` } : {}),
+  };
+}
+
 async function apiFetch(path: string, opts?: RequestInit) {
-  const cleanPath = path.startsWith('/api/') ? path.slice(4) : path;
-  return fetch(`${API}${cleanPath}`, {
+  return fetch(path, {
     ...opts,
     credentials: 'include',
-    headers: { 'Content-Type': 'application/json', ...(opts?.headers ?? {}) },
+    headers: { ...getAuthHeaders(), ...(opts?.headers ?? {}) },
   });
 }