diff --git a/dashcaddy-api/src/app.js b/dashcaddy-api/src/app.js
index 966e591..6cc5846 100644
--- a/dashcaddy-api/src/app.js
+++ b/dashcaddy-api/src/app.js
@@ -220,8 +220,8 @@ async function createApp() {
       req.url = '/api/v1' + req.url.slice(9); // '/api/auth'.length === 9
     } else if (req.url.startsWith('/api/v1/auth/totp/check-session')) {
       // Drift: /api/v1/auth/totp/check-session -> /api/v1/totp/check-session
-      // Drop the '/api/v1' prefix AND the '/auth' middle segment (13 chars total).
-      req.url = '/api/v1' + req.url.slice(13); // '/api/v1/auth'.length === 13
+      // Drop the '/api/v1/auth' prefix (12 chars), keep the leading '/'.
+      req.url = '/api/v1' + req.url.slice(12); // '/api/v1/auth'.length === 12
     }
     next();
   });