diff --git a/Caddyfile b/Caddyfile
index 6d47d7a..0e624b2 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -376,6 +376,13 @@ hermes.ginnoir.com {
 	}
 }
 
+# Hermes WebUI for browser/phone access to the valhalla Hermes runtime.
+# Internal-only; WebUI also enforces its own password auth.
+webui.ginnoir.com {
+	import internal_only
+	reverse_proxy 172.20.0.1:8787
+}
+
 backup.ginnoir.com {
 	route {
 		import authentik_outpost