diff --git a/deploy/angie/betterframe.docker.conf b/deploy/angie/betterframe.docker.conf
index 2b0d1c6..02e192f 100644
--- a/deploy/angie/betterframe.docker.conf
+++ b/deploy/angie/betterframe.docker.conf
@@ -63,14 +63,16 @@ server {
         proxy_send_timeout 86400s;
     }
 
-    # Admin debug WS (journal + terminal) — authenticated via API key in query.
-    location /ws/admin/debug/ {
-        proxy_pass http://betterframe_ws;
+    # Admin debug WS (journal + terminal) under /admin/ so Angie's existing
+    # /admin/* routing applies. Proxied to coordinator-ws (18082) not admin-http.
+    location /admin/ws/debug/ {
+        proxy_pass http://betterframe_ws/ws/admin/debug/;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "upgrade";
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header Cookie $http_cookie;
         proxy_read_timeout 86400s;
         proxy_send_timeout 86400s;
     }
diff --git a/server/src/plugins/service-admin-http/routes-admin.ts b/server/src/plugins/service-admin-http/routes-admin.ts
index 1f9bc94..bf3c822 100644
--- a/server/src/plugins/service-admin-http/routes-admin.ts
+++ b/server/src/plugins/service-admin-http/routes-admin.ts
@@ -1743,7 +1743,7 @@ export function registerAdminRoutes(app: H3, deps: AdminDeps): void {
         function connect(){
           // WS to coordinator — proxied through Angie at /ws/admin/debug/:id
           var proto=location.protocol==='https:'?'wss:':'ws:';
-          ws=new WebSocket(proto+'//'+location.host+'/ws/admin/debug/${id}');
+          ws=new WebSocket(proto+'//'+location.host+'/admin/ws/debug/${id}');
           ws.onmessage=function(e){
             try{var m=JSON.parse(e.data);
               if(m.type==='journal-line'){log.textContent+=m.line+'\\n';log.scrollTop=log.scrollHeight;}
@@ -1794,7 +1794,7 @@ export function registerAdminRoutes(app: H3, deps: AdminDeps): void {
         var ws;
         function connect(){
           var proto=location.protocol==='https:'?'wss:':'ws:';
-          ws=new WebSocket(proto+'//'+location.host+'/ws/admin/debug/${id}');
+          ws=new WebSocket(proto+'//'+location.host+'/admin/ws/debug/${id}');
           ws.onopen=function(){status.textContent='Connected (not authed)';};
           ws.onmessage=function(e){
             try{var m=JSON.parse(e.data);