diff --git a/infra/setup.ts b/infra/setup.ts
index bbb7a3a..01e31ab 100644
--- a/infra/setup.ts
+++ b/infra/setup.ts
@@ -111,6 +111,9 @@ services:
       - "traefik.http.routers.auth-api.entrypoints=websecure"
       - "traefik.http.routers.auth-api.tls=true"
       - "traefik.http.services.auth-api.loadbalancer.server.port=8000"
+      - "traefik.http.middlewares.auth-forward.forwardauth.address=http://auth-api:8000/api/forward-auth"
+      - "traefik.http.middlewares.auth-forward.forwardauth.trustForwardHeader=true"
+      - "traefik.http.middlewares.auth-forward.forwardauth.authResponseHeaders=X-Forwarded-User-Id,X-Forwarded-User,X-Forwarded-Scopes,X-Forwarded-App-Id"
     expose:
       - "8000"
     depends_on: