diff --git a/base/ingress/pingora-config.yaml b/base/ingress/pingora-config.yaml
index 68d6a66..d8f6382 100644
--- a/base/ingress/pingora-config.yaml
+++ b/base/ingress/pingora-config.yaml
@@ -167,19 +167,18 @@ data:
       prefix  = "/.well-known/"
       backend = "http://stalwart.stalwart.svc.cluster.local:8080"
 
-      # OAuth2/OIDC authorization callback
+      # Stalwart OAuth2 endpoints (/authorize/code, /auth/token, /auth/device)
       [[routes.paths]]
       prefix  = "/authorize"
       backend = "http://stalwart.stalwart.svc.cluster.local:8080"
 
-      # Stalwart admin + API
       [[routes.paths]]
-      prefix  = "/api"
+      prefix  = "/auth/"
       backend = "http://stalwart.stalwart.svc.cluster.local:8080"
 
-      # JMAP WebSocket
+      # Stalwart login page (used during OAuth flow)
       [[routes.paths]]
-      prefix  = "/ws"
+      prefix  = "/login"
       backend = "http://stalwart.stalwart.svc.cluster.local:8080"
 
     [[routes]]
@@ -312,6 +311,7 @@ data:
     [[routes]]
     host_prefix = "cal"
     # Default: redirect to unified Bulwark calendar UI.
+    backend     = "http://stalwart.stalwart.svc.cluster.local:8080"
     redirect    = "https://mail.DOMAIN_SUFFIX/calendar"
 
       # CalDAV protocol — external calendar clients connect here.