diff --git a/docs/tinfoil-direct-integration.md b/docs/tinfoil-direct-integration.md
index 22d1ab37..ce689203 100644
--- a/docs/tinfoil-direct-integration.md
+++ b/docs/tinfoil-direct-integration.md
@@ -410,8 +410,8 @@ and `routstr/upstream/ehbp.py`.
   - `forward_ehbp_x_cashu_request()`: if usage is available, computes the
     refund from actual cost instead of max cost.
 
-- `routstr/proxy.py`: `/attestation` and `/.well-known/` paths are forwarded
-  to all enabled upstreams without model/cost/auth lookups.
+- `routstr/proxy.py`: `/attestation` and `/tee/attestation` paths are forwarded
+  to Tinfoil upstreams without model/cost/auth lookups.
 
 ### Billing behavior
 
diff --git a/routstr/proxy.py b/routstr/proxy.py
index cd2369b2..593eea81 100644
--- a/routstr/proxy.py
+++ b/routstr/proxy.py
@@ -191,7 +191,6 @@ _API_PATH_PREFIXES = (
     "providers",
     "tee/",
     "attestation",
-    ".well-known/",
 )
 
 
@@ -234,14 +233,12 @@ async def proxy(
         else:
             model_id = request_body_dict.get("model", "unknown")
 
-    # /tee/*, /attestation and /.well-known/* GET requests don't map to models
-    # — forward without model/cost/auth lookups. Tinfoil attestation paths are
-    # routed only to Tinfoil providers so an unrelated upstream's 404 cannot
+    # /tee/* and /attestation GET requests don't map to models — forward
+    # without model/cost/auth lookups. Tinfoil attestation paths are routed
+    # only to Tinfoil providers so an unrelated upstream's 404 cannot
     # short-circuit before the attestation proxy is tried.
     if request.method == "GET" and (
-        path.startswith("tee/")
-        or path.startswith("attestation")
-        or path.startswith(".well-known/")
+        path.startswith("tee/") or path.startswith("attestation")
     ):
         selected_upstreams = _select_unauthenticated_get_upstreams(path, _upstreams)
         if not selected_upstreams: