diff --git a/WEB_DEPLOYMENT.md b/WEB_DEPLOYMENT.md
index 0c5f200..e842f9c 100644
--- a/WEB_DEPLOYMENT.md
+++ b/WEB_DEPLOYMENT.md
@@ -12,19 +12,13 @@ working services and redirect HTTP to HTTPS.
 
 ## Traefik
 
-Create three routers for `doctor.ranaze.com`, ordered by priority:
+Create one `websecure` router with a host rule for `doctor.ranaze.com` and route
+it to the Kubernetes nodes on port `30089`, the Web game NodePort. Reuse the existing
+certificate resolver, load-balancing node list, and HTTP-to-HTTPS middleware.
 
-1. `Host(`doctor.ranaze.com`) && PathPrefix(`/api/Auth`)` routes to the same
-   backend service used by `pauth.ranaze.com`.
-2. `Host(`doctor.ranaze.com`) && PathPrefix(`/api`)` routes to the Kubernetes
-   nodes on port `30088`, the Questions API NodePort.
-3. `Host(`doctor.ranaze.com`)` routes to the Kubernetes nodes on port `30089`,
-   the Web game NodePort.
-
-Do not strip any prefixes. Give the auth router the highest priority, the
-general API router the next-highest priority, and the Web router the lowest.
-Reuse the existing HTTPS entrypoint, certificate resolver, load-balancing node
-list, and HTTP-to-HTTPS middleware.
+The Web container proxies `/api/Auth/*` to `pauth.ranaze.com` and all other
+`/api/*` requests to `s3q.ranaze.com`, so Traefik does not need separate API
+routers or prefix middleware for this hostname.
 
 ## Verification
 
diff --git a/web/nginx.conf b/web/nginx.conf
index 449726c..0ca6ce4 100644
--- a/web/nginx.conf
+++ b/web/nginx.conf
@@ -13,6 +13,28 @@ server {
         return 200 "ok\n";
     }
 
+    location ^~ /api/Auth/ {
+        proxy_pass https://pauth.ranaze.com;
+        proxy_ssl_server_name on;
+        proxy_ssl_name pauth.ranaze.com;
+        proxy_set_header Host pauth.ranaze.com;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_connect_timeout 10s;
+        proxy_read_timeout 30s;
+    }
+
+    location ^~ /api/ {
+        proxy_pass https://s3q.ranaze.com;
+        proxy_ssl_server_name on;
+        proxy_ssl_name s3q.ranaze.com;
+        proxy_set_header Host s3q.ranaze.com;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_connect_timeout 10s;
+        proxy_read_timeout 60s;
+    }
+
     location = /index.html {
         add_header Cache-Control "no-cache, no-store, must-revalidate" always;
         add_header X-Content-Type-Options "nosniff" always;