diff --git a/internal/web/handlers.go b/internal/web/handlers.go
index 0614a22..bfb1d3f 100644
--- a/internal/web/handlers.go
+++ b/internal/web/handlers.go
@@ -83,6 +83,7 @@ func (a *App) logger() *slog.Logger {
 func (a *App) Router() http.Handler {
 	root := http.NewServeMux()
 	root.HandleFunc("GET /healthz", a.handleHealthz)
+	root.HandleFunc("GET /welcome", a.handleWelcome)
 	root.Handle("GET /static/", staticHandler())
 	root.Handle("/auth/", a.Auth.Routes())
 
@@ -117,6 +118,15 @@ func (a *App) Router() http.Handler {
 	return root
 }
 
+// handleWelcome renders the public landing page (/welcome). It is mounted outside
+// Auth.Middleware, so it must not assume a session: CurrentUser peeks the cookie
+// without redirecting and the page renders the logged-out or logged-in variant
+// accordingly.
+func (a *App) handleWelcome(w http.ResponseWriter, r *http.Request) {
+	user, ok := a.Auth.CurrentUser(r)
+	a.render(w, r, WelcomePage(user, ok))
+}
+
 // handleHealthz is the unauthenticated liveness/readiness probe.
 func (a *App) handleHealthz(w http.ResponseWriter, _ *http.Request) {
 	w.Header().Set("Content-Type", "text/plain; charset=utf-8")