diff --git a/containers/traefik/tasks.yml b/containers/traefik/tasks.yml
index 1329382..a1d254f 100644
--- a/containers/traefik/tasks.yml
+++ b/containers/traefik/tasks.yml
@@ -102,8 +102,9 @@
           io.containers.autoupdate: "registry"
           traefik.enable: "true"
           traefik.http.middlewares.traefik-auth.basicauth.users: "{{ vault_traefik_basic_auth }}"
+          traefik.http.middlewares.traefik-prefixstrip.stripprefix.prefixes: "/traefik"
           traefik.http.routers.traefik.entrypoints: "https"
-          traefik.http.routers.traefik.rule: "PathPrefix(`/traefik`)"
+          traefik.http.routers.traefik.rule: "PathPrefix(`/traefik`) || HeadersRegexp(`Referer`, `.*/traefik/.*`)"
           traefik.http.routers.traefik.middlewares: "traefik-auth@docker"
           traefik.http.routers.traefik.tls: "true"
           traefik.http.routers.traefik.tls.certresolver: "wildcard"
diff --git a/containers/traefik/templates/conf/cockpit.yml.j2 b/containers/traefik/templates/conf/cockpit.yml.j2
index 893fe28..a82ab1b 100644
--- a/containers/traefik/templates/conf/cockpit.yml.j2
+++ b/containers/traefik/templates/conf/cockpit.yml.j2
@@ -3,12 +3,20 @@ http:
     cockpit:
       rule: "PathPrefix(`/cockpit`)"
       entryPoints: https
+      middlewares:
+        - cockpit-stripprefix
       service: cockpit
       tls:
         certresolver: wildcard
 
+  middlewares:
+    cockpit-stripprefix:
+      stripPrefix:
+        prefixes:
+          - "/cockpit"
+
   services:
     cockpit:
       loadBalancer:
         servers:
-          - url: "http://{{ ansible_host }}:9090"
+          - url: "http://127.0.0.1:9090"