diff --git a/dashboard/app.py b/dashboard/app.py
index 7872a0a..4166fa9 100644
--- a/dashboard/app.py
+++ b/dashboard/app.py
@@ -16,14 +16,17 @@ DB_PATH = os.environ.get("DB_PATH", "/data/messages.db")
 Path(DB_PATH).parent.mkdir(parents=True, exist_ok=True)
 
 TOKEN = os.environ.get("DASHBOARD_TOKEN", "").strip()
-PUBLIC_ROUTES = {"/webhook", "/healthz"}
+# Public: HTML shell + static assets (login page needs to load) + webhook + health
+PUBLIC_ROUTES = {"/", "/webhook", "/healthz"}
+PUBLIC_PREFIXES = ("/static/",)
 
 app = Flask(__name__, static_folder="static", static_url_path="/static")
 
 
 @app.before_request
 def _check_token():
-    if not TOKEN or request.path in PUBLIC_ROUTES:
+    p = request.path
+    if not TOKEN or p in PUBLIC_ROUTES or p.startswith(PUBLIC_PREFIXES):
         return None
     supplied = (
         request.headers.get("Authorization", "").removeprefix("Bearer ").strip()