diff --git a/middleware.js b/middleware.js
index ff37fa1..a22afe6 100644
--- a/middleware.js
+++ b/middleware.js
@@ -1,7 +1,7 @@
 import { createServerClient } from "@supabase/ssr";
 import { NextResponse } from "next/server";
 
-const PUBLIC_PATHS = ["/login", "/auth"];
+const PUBLIC_PATHS = ["/login", "/auth", "/api/health"];
 
 export async function middleware(request) {
   const pathname = request.nextUrl.pathname;
diff --git a/tests/auth-boundary.test.js b/tests/auth-boundary.test.js
index 9cebe14..3ccedb0 100644
--- a/tests/auth-boundary.test.js
+++ b/tests/auth-boundary.test.js
@@ -69,6 +69,14 @@ describe("authenticated product boundary", () => {
     expect(mockGetAuthenticatedUser).not.toHaveBeenCalled();
   });
 
+  it("does not convert /api/health to 401 via middleware when unauthenticated", async () => {
+    mockGetUser.mockResolvedValue({ data: { user: null } });
+    const { middleware } = await import("@/middleware.js");
+    const response = await middleware(new NextRequest("http://localhost:3000/api/health"));
+
+    expect(response.status).toBe(200);
+  });
+
   it("redirects unauthenticated product access to the login surface", async () => {
     mockGetUser.mockResolvedValue({ data: { user: null } });
     const { middleware } = await import("@/middleware.js");