diff --git a/modules/services/immich.nix b/modules/services/immich.nix
index 55ebe7f..47e8076 100644
--- a/modules/services/immich.nix
+++ b/modules/services/immich.nix
@@ -544,6 +544,14 @@ in
         inherit (cfg) subdomain domain ssl;
         upstream = "http://127.0.0.1:${toString cfg.port}";
         autheliaRules = lib.mkIf (cfg.sso.enable) [
+          {
+            domain = fqdn;
+            policy = "bypass";
+            resources = [
+              "^/api.*"
+              "^/.well-known/immich"
+            ];
+          }
           {
             domain = fqdn;
             policy = cfg.sso.authorization_policy;