diff --git a/server.js b/server.js
index b541aca..d51ba2d 100644
--- a/server.js
+++ b/server.js
@@ -142,11 +142,8 @@ app.post('/api/reorder', requireAuth, async (req, res) => {
   }
 });
 
-// Static files
-app.use(express.static(path.join(__dirname, 'public')));
-
-// SPA fallback
-app.get('*', (req, res) => {
+// Auth gate — redirect to login page if not authenticated
+app.get('/', (req, res) => {
   if (isAuth(req)) {
     res.sendFile(path.join(__dirname, 'public', 'index.html'));
   } else {
@@ -154,4 +151,7 @@ app.get('*', (req, res) => {
   }
 });
 
+// Static files (login.html is public, index.html is gated above)
+app.use(express.static(path.join(__dirname, 'public'), { index: false }));
+
 app.listen(PORT, () => console.log(`TdB RdB — port ${PORT}`));