diff --git a/dynamic/openremote.yml b/dynamic/openremote.yml
index 14d23cf..83a8ffb 100644
--- a/dynamic/openremote.yml
+++ b/dynamic/openremote.yml
@@ -1,6 +1,16 @@
 # OpenRemote via Traefik (HTTPS)
 http:
   routers:
+    # Keycloak auth routes — HIGHER priority (matched first)
+    openremote-keycloak:
+      rule: "Host(`openremote.digitribe.fr`) && PathPrefix(`/auth`)"
+      entryPoints:
+        - websecure
+      service: openremote-keycloak
+      tls:
+        certResolver: letsencrypt
+      priority: 200
+    # OpenRemote Manager — catches everything else on this host
     openremote-manager:
       rule: "Host(`openremote.digitribe.fr`)"
       entryPoints:
@@ -20,3 +30,7 @@ http:
       loadBalancer:
         servers:
           - url: "http://openremote_manager_1:8080"
+    openremote-keycloak:
+      loadBalancer:
+        servers:
+          - url: "http://openremote-keycloak-1:8080"