diff --git a/traefik/compose.yaml b/traefik/compose.yaml
index 91e4d67..84b81b0 100644
--- a/traefik/compose.yaml
+++ b/traefik/compose.yaml
@@ -54,7 +54,9 @@ services:
       traefik.http.routers.dashboard.entrypoints: websecure
       traefik.http.routers.dashboard.tls.certresolver: le
       traefik.http.routers.dashboard.service: api@internal
-      traefik.http.routers.dashboard.middlewares: sso,secure-headers@file
+      # secure-headers first: sso answers unauthenticated requests itself, and
+      # middlewares after it never see that response.
+      traefik.http.routers.dashboard.middlewares: secure-headers@file,sso
       # Keycloak gate for the dashboard host only (cookie, return hosts and
       # role are tied to it; README "Adding a project"): unauthenticated
       # requests are sent to Keycloak, users without petrolyst:traefik-admin