diff --git a/apps/web/__tests__/unit/proxy-self-hosted.test.ts b/apps/web/__tests__/unit/proxy-self-hosted.test.ts
index ad20bffdb3..5ee2e01043 100644
--- a/apps/web/__tests__/unit/proxy-self-hosted.test.ts
+++ b/apps/web/__tests__/unit/proxy-self-hosted.test.ts
@@ -3,6 +3,12 @@ import { join } from "node:path";
 import { describe, expect, it } from "vitest";
 
 describe("self-hosted proxy routes", () => {
+	it("does not send public assets through the self-hosted login redirect", () => {
+		const source = readFileSync(join(process.cwd(), "proxy.ts"), "utf8");
+		expect(source).toContain("svg");
+		expect(source).toContain("woff2?");
+	});
+
 	it("allows browser-based CLI authorization pages", () => {
 		const source = readFileSync(join(process.cwd(), "proxy.ts"), "utf8");
 		expect(source).toContain('path.startsWith("/cli/")');
diff --git a/apps/web/proxy.ts b/apps/web/proxy.ts
index d5983c84dd..4e951343e0 100644
--- a/apps/web/proxy.ts
+++ b/apps/web/proxy.ts
@@ -132,6 +132,6 @@ export async function proxy(request: NextRequest) {
 
 export const config = {
 	matcher: [
-		"/((?!api|_next/static|_next/image|favicon.ico|robots.txt|sitemap.xml).*)",
+		"/((?!api|_next/static|_next/image|favicon.ico|robots.txt|sitemap.xml|.*\\.(?:avif|css|gif|ico|jpe?g|js|map|mp3|mp4|png|svg|webmanifest|webp|woff2?)).*)",
 	],
 };