diff --git a/Caddyfile b/Caddyfile
index 82a3e83..b0e1fc7 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -360,6 +360,22 @@ homarr.ginnoir.com {
 	reverse_proxy homarr:7575
 }
 
+# Hermes Desktop remote backend. Browser UI is SSO-gated; API/WS paths
+# are passed through so Desktop clients can authenticate with the Hermes
+# dashboard session token instead of an Authentik browser cookie.
+hermes.ginnoir.com {
+	route {
+		import authentik_outpost
+		handle /api/* {
+			reverse_proxy 172.20.0.1:9119
+		}
+		handle {
+			import authentik_forward_auth
+			reverse_proxy 172.20.0.1:9119
+		}
+	}
+}
+
 backup.ginnoir.com {
 	route {
 		import authentik_outpost