headscale ingress-private
diff --git a/core/auth/ui/hydra.go b/core/auth/ui/hydra.go
index 8a0dea0..8775d9e 100644
--- a/core/auth/ui/hydra.go
+++ b/core/auth/ui/hydra.go
@@ -41,9 +41,9 @@
 	req := &http.Request{
 		Method: http.MethodPut,
 		URL: &url.URL{
-			Scheme:   "https",
+			Scheme:   "http",
 			Host:     c.host,
-			Path:     "/oauth2/auth/requests/login/accept",
+			Path:     "/admin/oauth2/auth/requests/login/accept",
 			RawQuery: fmt.Sprintf("login_challenge=%s", challenge),
 		},
 		Header: map[string][]string{
@@ -75,9 +75,9 @@
 	req := &http.Request{
 		Method: http.MethodPut,
 		URL: &url.URL{
-			Scheme:   "https",
+			Scheme:   "http",
 			Host:     c.host,
-			Path:     "/oauth2/auth/requests/login/reject",
+			Path:     "/admin/oauth2/auth/requests/login/reject",
 			RawQuery: fmt.Sprintf("login_challenge=%s", challenge),
 		},
 		Header: map[string][]string{
@@ -110,7 +110,7 @@
 
 func (c *HydraClient) GetConsentChallenge(challenge string) (RequestedConsent, error) {
 	var consent RequestedConsent
-	resp, err := c.httpClient.Get(fmt.Sprintf("https://%s/oauth2/auth/requests/consent?consent_challenge=%s", c.host, challenge))
+	resp, err := c.httpClient.Get(fmt.Sprintf("http://%s/admin/oauth2/auth/requests/consent?consent_challenge=%s", c.host, challenge))
 	if err != nil {
 		return consent, err
 	}
@@ -140,9 +140,9 @@
 	req := &http.Request{
 		Method: http.MethodPut,
 		URL: &url.URL{
-			Scheme:   "https",
+			Scheme:   "http",
 			Host:     c.host,
-			Path:     "/oauth2/auth/requests/consent/accept",
+			Path:     "/admin/oauth2/auth/requests/consent/accept",
 			RawQuery: fmt.Sprintf("challenge=%s", challenge),
 		},
 		Header: map[string][]string{