diff --git a/core/installer/app_configs/app_base.cue b/core/installer/app_configs/app_base.cue
index 4075281..74860fa 100644
--- a/core/installer/app_configs/app_base.cue
+++ b/core/installer/app_configs/app_base.cue
@@ -38,7 +38,7 @@
 #Auth: {
 	enabled: bool | *false // TODO(gio): enabled by default?
 	groups: string | *"" // TODO(gio): []string
-	noAuthPathPrefixes: [...string] | *[]
+	noAuthPathPatterns: [...string] | *[]
 }
 
 #Image: {
diff --git a/core/installer/app_configs/app_global_env.cue b/core/installer/app_configs/app_global_env.cue
index fba9dcf..32cc63d 100644
--- a/core/installer/app_configs/app_global_env.cue
+++ b/core/installer/app_configs/app_global_env.cue
@@ -114,7 +114,7 @@
 						membershipPublicAddr: "https://memberships.\(g.privateDomain)"
 					}
 					groups: auth.groups
-					noAuthPathPrefixes: strings.Join(auth.noAuthPathPrefixes, ",")
+					noAuthPathPatterns: strings.Join(auth.noAuthPathPatterns, ",")
 					portName: _authProxyHTTPPortName
 				}
 			}
diff --git a/core/installer/server/dodo-app/static/schemas/app.schema.json b/core/installer/server/dodo-app/static/schemas/app.schema.json
index 6e49d62..5450358 100644
--- a/core/installer/server/dodo-app/static/schemas/app.schema.json
+++ b/core/installer/server/dodo-app/static/schemas/app.schema.json
@@ -236,12 +236,9 @@
                 "groups": {
                   "type": "string"
                 },
-                "noAuthPathPrefixes": {
+                "noAuthPathPatterns": {
                   "type": "array",
-                  "items": {
-                    "type": "string",
-					"pattern": "^/.*"
-                  }
+                  "items": { "type": "string" }
                 }
               },
               "additionalProperties": false,
diff --git a/core/installer/values-tmpl/dodo-app.cue b/core/installer/values-tmpl/dodo-app.cue
index cb61b45..1c5939b 100644
--- a/core/installer/values-tmpl/dodo-app.cue
+++ b/core/installer/values-tmpl/dodo-app.cue
@@ -105,10 +105,10 @@
 				}
 				if !input.external {
 					enabled: true
-					noAuthPathPrefixes: [
-						"/static/",
-						"/schemas/",
-						"/api/public-data",
+					noAuthPathPatterns: [
+						"^/static/.*$",
+						"^/schemas/.*$",
+						"^/api/public-data$",
 				    ]
 				}
 			}