diff --git a/dashcaddy-api/src/app.js b/dashcaddy-api/src/app.js
index e1cca0f..cf03b17 100644
--- a/dashcaddy-api/src/app.js
+++ b/dashcaddy-api/src/app.js
@@ -192,12 +192,18 @@ async function createApp() {
   // auto-login pages) historically call these endpoints under the pre-1.5.0
   // prefix `/api/auth/...`. The canonical mount is `/api/v1`. Hand-maintained
   // Caddyfiles have repeatedly drifted back to the old prefix and 404'd the SSO
-  // gate (breaking Plex/Jellyfin/Emby/chat). Transparently rewrite ONLY these two
-  // auth paths to the v1 mount so the gate is tolerant of that drift. Must run
-  // before configureMiddleware() so CSRF/auth see the canonical path. This is
-  // deliberately narrow — NOT a general `/api` -> `/api/v1` alias.
+  // gate (breaking Plex/Jellyfin/Emby/chat). Transparently rewrite ONLY these
+  // three auth paths to the v1 mount so the gate is tolerant of that drift.
+  // Must run before configureMiddleware() so CSRF/auth see the canonical path.
+  // This is deliberately narrow — NOT a general `/api` -> `/api/v1` alias.
+  // /api/auth/totp/check-session is added because the auto-login page JS in
+  // sso-gate.js (buildLoginPage) uses the legacy prefix; without this rewrite
+  // the JS gets a 404 and the page hangs at "Signing in to Plex..." forever
+  // (user-reported 2026-07-09).
   app.use((req, res, next) => {
-    if (req.url.startsWith('/api/auth/gate/') || req.url.startsWith('/api/auth/app-token/')) {
+    if (req.url.startsWith('/api/auth/gate/')
+        || req.url.startsWith('/api/auth/app-token/')
+        || req.url.startsWith('/api/auth/totp/check-session')) {
       req.url = '/api/v1' + req.url.slice(4); // '/api'.length === 4
     }
     next();