diff --git a/base/ingress/pingora-config.yaml b/base/ingress/pingora-config.yaml
index ef498f8..62e0b0b 100644
--- a/base/ingress/pingora-config.yaml
+++ b/base/ingress/pingora-config.yaml
@@ -222,18 +222,34 @@ data:
     host_prefix = "metrics"
     backend     = "http://kube-prometheus-stack-grafana.monitoring.svc.cluster.local:80"
 
+    # Observability APIs — gated behind OIDC auth_request.
     [[routes]]
     host_prefix = "systemmetrics"
     backend     = "http://kube-prometheus-stack-prometheus.monitoring.svc.cluster.local:9090"
 
+      [[routes.paths]]
+      prefix       = "/"
+      backend      = "http://kube-prometheus-stack-prometheus.monitoring.svc.cluster.local:9090"
+      auth_request = "http://hydra-public.ory.svc.cluster.local:4444/userinfo"
+
     [[routes]]
     host_prefix = "systemlogs"
     backend     = "http://loki-gateway.monitoring.svc.cluster.local:80"
 
+      [[routes.paths]]
+      prefix       = "/"
+      backend      = "http://loki-gateway.monitoring.svc.cluster.local:80"
+      auth_request = "http://hydra-public.ory.svc.cluster.local:4444/userinfo"
+
     [[routes]]
     host_prefix = "systemtracing"
     backend     = "http://tempo.monitoring.svc.cluster.local:3200"
 
+      [[routes.paths]]
+      prefix       = "/"
+      backend      = "http://tempo.monitoring.svc.cluster.local:3200"
+      auth_request = "http://hydra-public.ory.svc.cluster.local:4444/userinfo"
+
     [[routes]]
     host_prefix = "livekit"
     backend     = "http://livekit-server.media.svc.cluster.local:80"