diff --git a/services/nginx.nix b/services/nginx.nix
index 866356f..7476cd0 100644
--- a/services/nginx.nix
+++ b/services/nginx.nix
@@ -113,13 +113,20 @@ in
         # handshake — /ws would 401 forever and chat would silently never
         # connect. Video stays gated; only the chat socket is reachable by
         # someone who already knows the hostname.
+        #
+        # /admin and /api/admin are exempt too, for a different reason:
+        # Owncast enforces its own basic auth there (user "admin"). Two
+        # basic-auth realms on one origin deadlock — the browser can only send
+        # one Authorization header and nginx forwards it verbatim, so the
+        # credential that satisfies nginx is rejected by Owncast and vice
+        # versa. Let Owncast's own login be the only gate on those paths.
         "watch.nordhammer.it"    = lib.recursiveUpdate (proxy 8088) {
           basicAuth = { blizzcon = "Blizzcon"; };
-          locations."/ws" = {
+          locations = lib.genAttrs [ "/ws" "/admin" "/api/admin" ] (_: {
             proxyPass = "http://127.0.0.1:8088";
             proxyWebsockets = true;
             extraConfig = "auth_basic off;";
-          };
+          });
         };
 
         # wings daemon (see services/pelican.nix). Deliberately NOT behind