diff --git a/scripts/src/hwlab-node/public-exposure.test.ts b/scripts/src/hwlab-node/public-exposure.test.ts
index c817634c..07184e36 100644
--- a/scripts/src/hwlab-node/public-exposure.test.ts
+++ b/scripts/src/hwlab-node/public-exposure.test.ts
@@ -25,6 +25,6 @@ test("public exposure leaves auth routes on cloud-web same-origin proxy", () =>
 
   assert.match(block, /@api path \/health\* \/v1\* \/json-rpc\* \/openapi\* \/docs\* \/swagger\*/u);
   assert.doesNotMatch(block, /@api path[^\n]*\/auth\*/u);
-  assert.match(block, /reverse_proxy @api 127\.0\.0\.1:22089/u);
-  assert.match(block, /reverse_proxy 127\.0\.0\.1:22090/u);
+  assert.match(block, /handle @api \{\n\s+reverse_proxy 127\.0\.0\.1:22089/u);
+  assert.match(block, /handle \{\n\s+reverse_proxy 127\.0\.0\.1:22090/u);
 });
diff --git a/scripts/src/hwlab-node/public-exposure.ts b/scripts/src/hwlab-node/public-exposure.ts
index bb2ad880..2b0ba8bd 100644
--- a/scripts/src/hwlab-node/public-exposure.ts
+++ b/scripts/src/hwlab-node/public-exposure.ts
@@ -985,14 +985,18 @@ export function publicExposureCaddyBlock(exposure: HwlabRuntimePublicExposureSpe
   const tlsLines = exposure.caddyTls === "internal" ? "    tls internal\n" : "";
   const mainBlock = `${exposure.hostname} {
 ${tlsLines}    @api path /health* /v1* /json-rpc* /openapi* /docs* /swagger*
-    reverse_proxy @api 127.0.0.1:${exposure.apiProxy.remotePort} {
-        transport http {
-            response_header_timeout ${exposure.responseHeaderTimeoutSeconds}s
+    handle @api {
+        reverse_proxy 127.0.0.1:${exposure.apiProxy.remotePort} {
+            transport http {
+                response_header_timeout ${exposure.responseHeaderTimeoutSeconds}s
+            }
         }
     }
-    reverse_proxy 127.0.0.1:${exposure.webProxy.remotePort} {
-        transport http {
-            response_header_timeout ${exposure.responseHeaderTimeoutSeconds}s
+    handle {
+        reverse_proxy 127.0.0.1:${exposure.webProxy.remotePort} {
+            transport http {
+                response_header_timeout ${exposure.responseHeaderTimeoutSeconds}s
+            }
         }
     }
 }`;