diff --git a/gatus/config.yaml b/gatus/config.yaml
index c736179..fccd025 100644
--- a/gatus/config.yaml
+++ b/gatus/config.yaml
@@ -69,9 +69,11 @@ endpoints:
     group: rubenhensen.nl
     url: https://longhorn.rubenhensen.nl
     interval: 60s
-    # Behind basic auth, so 401 means it's up
+    # Envoy sends visitors to authentik first, so a redirect means it's up
+    client:
+      ignore-redirect: true
     conditions:
-      - "[STATUS] == 401"
+      - "[STATUS] == 302"
       - "[CERTIFICATE_EXPIRATION] > 168h"
   - name: serpbear
     group: rubenhensen.nl
diff --git a/nix-infra-machine/nodes/node001.nix b/nix-infra-machine/nodes/node001.nix
index 7157f25..543e0ea 100644
--- a/nix-infra-machine/nodes/node001.nix
+++ b/nix-infra-machine/nodes/node001.nix
@@ -51,11 +51,14 @@ let
 
   # Per-host tweaks on top of the default check.
   gatusOverrides = {
-    # Behind basic auth, so 401 means it's up
-    "longhorn.rubenhensen.nl".conditions = [
-      "[STATUS] == 401"
-      "[CERTIFICATE_EXPIRATION] > 168h"
-    ];
+    # Envoy sends visitors to authentik first, so a redirect means it's up
+    "longhorn.rubenhensen.nl" = {
+      client.ignore-redirect = true;
+      conditions = [
+        "[STATUS] == 302"
+        "[CERTIFICATE_EXPIRATION] > 168h"
+      ];
+    };
     # mod_auth_openidc answers 401 instead of redirecting to the login
     # page unless the client asks for HTML
     "rss.rubenhensen.nl".headers.Accept = "text/html";