diff --git a/internal/web/dist/index.html b/internal/web/dist/index.html
index f61ba25..9b21560 100644
--- a/internal/web/dist/index.html
+++ b/internal/web/dist/index.html
@@ -2,11 +2,11 @@
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
-    <link rel="icon" type="image/svg+xml" href="./favicon.svg" />
+    <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>web</title>
-    <script type="module" crossorigin src="./assets/index-Dh5C0Ucn.js"></script>
-    <link rel="stylesheet" crossorigin href="./assets/index-CZ8p4VMZ.css">
+    <script type="module" crossorigin src="/assets/index-D_F84V7q.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-CZ8p4VMZ.css">
   </head>
   <body>
     <div id="root"></div>
diff --git a/web/vite.config.ts b/web/vite.config.ts
index 44004e8..2ceb29f 100644
--- a/web/vite.config.ts
+++ b/web/vite.config.ts
@@ -6,7 +6,11 @@ import { defineConfig } from 'vite'
 // the app always talks to a relative `/api` base. During development Vite
 // proxies that prefix to a locally running fancy-dns.
 export default defineConfig({
-  base: './',
+  // BrowserRouter routes such as /auth/login are served by the SPA fallback.
+  // A relative base makes their asset URLs resolve under /auth/assets, which
+  // the fallback answers with index.html and leaves the page blank. Rooted
+  // URLs keep assets and API calls on the application origin at every route.
+  base: '/',
   plugins: [react(), tailwindcss()],
   server: {
     proxy: {