diff --git a/content/en/3.serveex/4.monitoring/1.uptime-kuma.md b/content/en/3.serveex/4.monitoring/1.uptime-kuma.md
index 3e62a6e..34ba014 100644
--- a/content/en/3.serveex/4.monitoring/1.uptime-kuma.md
+++ b/content/en/3.serveex/4.monitoring/1.uptime-kuma.md
@@ -192,7 +192,7 @@ sudo nano /srv/docker/swag/config/nginx/proxy-confs/stats.subdomain.conf
 
 ### Add the forward-auth check and public paths
 
-Replace the file's content with the following. The `location ~ ^/(...)` block matches Uptime-Kuma's public status page and its assets, and is served directly, without ever reaching the `auth_request` check in `location /`:
+Replace the file's content with the following. The `location ~ ^/(...)` block matches Uptime-Kuma's public status page and its assets, and is served directly, without ever reaching the `auth_request` check in `location /`. Only `api/status-page` is left public, not all of `/api`, since the rest of Uptime-Kuma's API is meant to stay behind authentication; `/metrics` (Uptime-Kuma's Prometheus endpoint) is left out of the regex entirely for the same reason:
 
 ```nginx [stats.subdomain.conf]{9-16,32-33}
 server {
@@ -203,7 +203,7 @@ server {
 
     include /config/nginx/ssl.conf;
 
-    location ~ ^/(status|assets|icon\.svg|api|upload|metrics) {
+    location ~ ^/(status|assets|icon\.svg|api/status-page|upload) {
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
         set $upstream_app uptime-kuma;
diff --git a/content/fr/3.serveex/4.monitoring/1.uptime-kuma.md b/content/fr/3.serveex/4.monitoring/1.uptime-kuma.md
index 8ddc77d..d946a84 100644
--- a/content/fr/3.serveex/4.monitoring/1.uptime-kuma.md
+++ b/content/fr/3.serveex/4.monitoring/1.uptime-kuma.md
@@ -192,7 +192,7 @@ sudo nano /srv/docker/swag/config/nginx/proxy-confs/stats.subdomain.conf
 
 ### Ajouter la vérification forward-auth et les chemins publics
 
-Remplacez le contenu du fichier par ce qui suit. Le bloc `location ~ ^/(...)` correspond à la page de statut publique d'Uptime-Kuma et à ses ressources, et est servi directement, sans jamais atteindre la vérification `auth_request` du `location /` :
+Remplacez le contenu du fichier par ce qui suit. Le bloc `location ~ ^/(...)` correspond à la page de statut publique d'Uptime-Kuma et à ses ressources, et est servi directement, sans jamais atteindre la vérification `auth_request` du `location /`. Seul `api/status-page` est laissé public, pas tout `/api`, car le reste de l'API d'Uptime-Kuma doit rester derrière l'authentification ; `/metrics` (l'endpoint Prometheus d'Uptime-Kuma) est volontairement absent de la regex pour la même raison :
 
 ```nginx [stats.subdomain.conf]{9-16,32-33}
 server {
@@ -203,7 +203,7 @@ server {
 
     include /config/nginx/ssl.conf;
 
-    location ~ ^/(status|assets|icon\.svg|api|upload|metrics) {
+    location ~ ^/(status|assets|icon\.svg|api/status-page|upload) {
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
         set $upstream_app uptime-kuma;