diff --git a/apps/prod/llamactl-proxy/ingress.yaml b/apps/prod/llamactl-proxy/ingress.yaml
index ea036a9..4dd63d6 100644
--- a/apps/prod/llamactl-proxy/ingress.yaml
+++ b/apps/prod/llamactl-proxy/ingress.yaml
@@ -7,8 +7,25 @@ spec:
   entryPoints:
     - websecure
   routes:
+  # Protected route for internal management API
+  - match: Host(`${LLAMACTL_DOMAIN}`) && PathPrefix(`/api/v1`)
+    kind: Rule
+    services:
+    - name: llamactl-proxy
+      port: ${LLAMACTL_INTERNAL_PORT}
+    middlewares:
+      - name: "auth-authelia@kubernetescrd"
+  # Unprotected route for OpenAI compatible API (uses API keys)
+  - match: Host(`${LLAMACTL_DOMAIN}`) && PathPrefix(`/v1`)
+    kind: Rule
+    services:
+    - name: llamactl-proxy
+      port: ${LLAMACTL_INTERNAL_PORT}
+  # Catch-all route
   - match: Host(`${LLAMACTL_DOMAIN}`)
     kind: Rule
     services:
     - name: llamactl-proxy
-      port: ${LLAMACTL_INTERNAL_PORT}
\ No newline at end of file
+      port: ${LLAMACTL_INTERNAL_PORT}
+    middlewares:
+      - name: "auth-authelia@kubernetescrd"
\ No newline at end of file