diff --git a/k8s/apps/comfyui/ingress.yaml b/k8s/apps/comfyui/ingress.yaml
index 49aa6c7..f76538d 100644
--- a/k8s/apps/comfyui/ingress.yaml
+++ b/k8s/apps/comfyui/ingress.yaml
@@ -29,18 +29,6 @@ spec:
     - host: comfyui.riotpiao.com
       http:
         paths:
-          # The login path lives on the SAME ingress as the app. Two Ingresses on
-          # one host do not merge their annotations: nginx applies the annotations
-          # of a single ingress per host, so a separate /oauth2 object silently
-          # dropped the auth_request above and every request fell through to the
-          # backend, which answered 404.
-          - path: /oauth2
-            pathType: Prefix
-            backend:
-              service:
-                name: comfyui-oauth2-proxy
-                port:
-                  number: 4180
           - path: /
             pathType: Prefix
             backend:
diff --git a/k8s/apps/comfyui/oauth2-proxy.yaml b/k8s/apps/comfyui/oauth2-proxy.yaml
index e67ed8c..d6902a6 100644
--- a/k8s/apps/comfyui/oauth2-proxy.yaml
+++ b/k8s/apps/comfyui/oauth2-proxy.yaml
@@ -78,3 +78,28 @@ spec:
     app: comfyui-oauth2-proxy
   ports:
     - {name: http, port: 4180, targetPort: http}
+---
+# The login path must NOT be gated: a request to /oauth2/start that itself demands a
+# login redirects to /oauth2/start forever. ingress-nginx applies the annotations of
+# an ingress to the locations it defines, so a separate object without auth-url keeps
+# this path open. The earlier failure of this shape was not the split — it was the
+# configuration-snippet on the app ingress, which made the controller drop the whole
+# object and left only this one alive.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: comfyui-oauth2
+  namespace: comfyui
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: comfyui.riotpiao.com
+      http:
+        paths:
+          - path: /oauth2
+            pathType: Prefix
+            backend:
+              service:
+                name: comfyui-oauth2-proxy
+                port:
+                  number: 4180