diff --git a/apps/fc-desktop/fc-desktop.yaml b/apps/fc-desktop/fc-desktop.yaml
index dc49ae5..786a087 100644
--- a/apps/fc-desktop/fc-desktop.yaml
+++ b/apps/fc-desktop/fc-desktop.yaml
@@ -23,8 +23,23 @@ spec:
   entryPoints:
     - websecure
   routes:
+    # Single-host Guacamole routing: Traefik forwards the /guacamole
+    # path-prefix directly to the guacamole Service in the guacamole
+    # namespace. Must precede the catch-all Host() rule so priority
+    # resolves the more-specific match first. RemoteDesktop.Web then
+    # emits launch URLs with host=desktop.iamworkin.lan + /guacamole
+    # prefix, keeping Guacamole reachable through the same public
+    # surface (GuacamolePublicUrl=https://desktop.iamworkin.lan/guacamole).
+    - match: Host(`desktop.iamworkin.lan`) && PathPrefix(`/guacamole`)
+      kind: Rule
+      priority: 20
+      services:
+        - name: guacamole
+          namespace: guacamole
+          port: 8080
     - match: Host(`desktop.iamworkin.lan`)
       kind: Rule
+      priority: 10
       services:
         - name: remotedesktop-web
           port: 8080