diff --git a/docs/authentication.md b/docs/authentication.md
index e9628757..0e39b0ba 100644
--- a/docs/authentication.md
+++ b/docs/authentication.md
@@ -19,7 +19,7 @@ machinery that remains behind the switch.
 ## Signed in at PedsHub means signed in here
 
 A visitor with no session here is not shown the sign-in page straight away.
-The page first asks the provider silently (`/api/auth/oidc/login?silent=1`,
+The page first asks the provider silently (`/api/auth/oidc?silent=1`,
 which adds `prompt=none`): someone already signed in at sso.pedshub.com — from
 the quiz app, say, following a deck link — arrives signed in without a click,
 the way a Kerberos ticket carries across services. Someone not signed in there
diff --git a/public/js/auth.js b/public/js/auth.js
index 9a171127..bd63737c 100644
--- a/public/js/auth.js
+++ b/public/js/auth.js
@@ -333,7 +333,7 @@ document.addEventListener('DOMContentLoaded', function() {
         sessionStorage.setItem('ped_sso_silent', '1');
         if (window.location.hash) sessionStorage.setItem('ped_pending_hash', window.location.hash);
       } catch (e) {}
-      window.location.replace('/api/auth/oidc/login?silent=1');
+      window.location.replace('/api/auth/oidc?silent=1');
     }).catch(function() { showAuthScreen(); });
   }
   function restorePendingHash() {