diff --git a/CLAUDE.md b/CLAUDE.md
index f99bb85..0692e30 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -159,6 +159,20 @@ reloads Caddy. No-ops silently if Caddy isn't installed. The fourth argument
 is an optional string inserted verbatim inside the Caddy site block (use it
 for `import authelia` or custom matchers).
 
+The function places that block **before** `reverse_proxy` in the generated
+site block — don't reorder this. `forward_auth` (what `import authelia`
+expands to) is the same directive family as `reverse_proxy` internally, and
+Caddy doesn't reorder repeats of the same directive within a block; it runs
+them in the order they're written. `reverse_proxy` written first would
+handle and terminate every request immediately, making an auth check
+written after it dead code that never runs — full bypass regardless of what
+the auth server's own access-control rules say. Confirmed live: this was
+the actual cause of a "Caddy proxies fine but Authelia never prompts for
+login" bug, on a site block that otherwise looked completely correct. If a
+service builds its own site block instead of using this helper (e.g.
+`services/asterisk-digital-ocean.sh` does, deliberately, see its own
+comment for why), put its auth block first there too.
+
 Sets two out-params (not `local` — read them after the call returns) so the
 caller can tell whether Caddy actually ended up fronting the service:
 
diff --git a/lib/common.sh b/lib/common.sh
index 80102ad..eca7cf0 100644
--- a/lib/common.sh
+++ b/lib/common.sh
@@ -573,6 +573,14 @@ configure_caddy_for_service() {
 
 # $SERVICE_NAME
 ${SERVICE_DOMAIN} {
+    # Auth (if any) must come before reverse_proxy — forward_auth is the
+    # same directive family as reverse_proxy internally, and Caddy doesn't
+    # reorder repeats of the same directive within a block; it runs them in
+    # the order they're written. With reverse_proxy first, it would handle
+    # and terminate every request immediately, so an auth check written
+    # after it would be dead code that never runs — full bypass regardless
+    # of what the auth server's own rules say.
+${EXTRA_CONFIG}
     reverse_proxy ${_BLOCK_UPSTREAM}
 
     # Security headers
@@ -588,7 +596,6 @@ ${SERVICE_DOMAIN} {
         output file /var/log/caddy/${SERVICE_DOMAIN}.log
         format json
     }
-${EXTRA_CONFIG}
 }
 CADDY_BLOCK
 )"
diff --git a/services/asterisk-digital-ocean.sh b/services/asterisk-digital-ocean.sh
index 6282c44..480fb23 100755
--- a/services/asterisk-digital-ocean.sh
+++ b/services/asterisk-digital-ocean.sh
@@ -628,6 +628,14 @@ ENV
 
 # Asterisk Web Admin
 ${DOMAIN_NAME} {
+    # Auth (if any) must come before reverse_proxy — forward_auth is the
+    # same directive family as reverse_proxy internally, and Caddy doesn't
+    # reorder repeats of the same directive within a block; it runs them in
+    # the order they're written. With reverse_proxy first, it would handle
+    # and terminate every request immediately, so an auth check written
+    # after it would be dead code that never runs — full bypass regardless
+    # of what the auth server's own rules say.
+${EXTRA_BLOCK}
     reverse_proxy ${_PROXY_TARGET}
 
     header {
@@ -641,7 +649,6 @@ ${DOMAIN_NAME} {
         output file /var/log/caddy/${DOMAIN_NAME}.log
         format json
     }
-${EXTRA_BLOCK}
 }
 CADDY_BLOCK
 )"