diff --git a/internal/web/oidc/oidc.go b/internal/web/oidc/oidc.go
index 57da714..d42a5c1 100644
--- a/internal/web/oidc/oidc.go
+++ b/internal/web/oidc/oidc.go
@@ -305,5 +305,5 @@ func (d *DexAuth) clearSessionCookie(w http.ResponseWriter) {
 }
 
 func isPublicPath(p string) bool {
-	return p == "/healthz" || strings.HasPrefix(p, "/auth/")
+	return p == "/healthz" || p == "/welcome" || strings.HasPrefix(p, "/auth/")
 }
diff --git a/internal/web/oidc/oidc_test.go b/internal/web/oidc/oidc_test.go
index 929cdff..889aa80 100644
--- a/internal/web/oidc/oidc_test.go
+++ b/internal/web/oidc/oidc_test.go
@@ -280,7 +280,7 @@ func TestMiddlewarePublicPathsBypassAuth(t *testing.T) {
 		w.WriteHeader(http.StatusOK)
 	}))
 
-	for _, path := range []string{"/healthz", "/auth/login"} {
+	for _, path := range []string{"/healthz", "/welcome", "/auth/login"} {
 		rec := httptest.NewRecorder()
 		guarded.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, path, nil))
 		require.Equal(t, http.StatusOK, rec.Code, "expected %s to bypass auth", path)