diff --git a/apps/app/proxy.ts b/apps/app/proxy.ts
index 7d982aaa..4d955154 100644
--- a/apps/app/proxy.ts
+++ b/apps/app/proxy.ts
@@ -14,15 +14,15 @@ const LANDING_PATH = "/";
 
 const SIGN_IN_PATH = "/sign-in";
 
-const PUBLIC = [SIGN_IN_PATH];
-
-const UNGATED = [SIGN_IN_PATH, "/grant-access", "/eve"];
+const UNGATED = ["/grant-access", "/eve"];
 
 const SECTIONS = ["/companies", "/contacts", "/deals", "/settings"];
 
 export async function proxy(request: NextRequest) {
 	const { pathname } = request.nextUrl;
 
+	if (pathname === SIGN_IN_PATH) return NextResponse.next();
+
 	if (
 		getSessionCookie(request, { cookiePrefix: AUTH_COOKIE_PREFIX }) === null
 	) {
@@ -71,9 +71,7 @@ function isUnder(pathname: string, prefix: string): boolean {
 }
 
 function isPublic(pathname: string): boolean {
-	if (pathname === LANDING_PATH) return isMarketing();
-
-	return PUBLIC.some((prefix) => isUnder(pathname, prefix));
+	return pathname === LANDING_PATH && isMarketing();
 }
 
 function isUngated(pathname: string): boolean {
diff --git a/apps/app/test/onboarding-gate.spec.ts b/apps/app/test/onboarding-gate.spec.ts
index 42122b76..b1bd45e1 100644
--- a/apps/app/test/onboarding-gate.spec.ts
+++ b/apps/app/test/onboarding-gate.spec.ts
@@ -170,6 +170,19 @@ describe("proxy", () => {
 		expect(redirectedTo(await proxy(request("/sign-in")))).toBeNull();
 	});
 
+	it("never aims a redirect at the sign-in page itself", async () => {
+		marketing(undefined);
+		setup({ onboarded: false, configured: false });
+
+		expect(redirectedTo(await proxy(request("/sign-in")))).toBeNull();
+		expect(
+			redirectedTo(await proxy(request("/sign-in", [SESSION_COOKIE]))),
+		).toBeNull();
+		expect(
+			redirectedTo(await proxy(request("/sign-in?method=google"))),
+		).toBeNull();
+	});
+
 	it("reads the flag on every request, and only the literal true turns it on", async () => {
 		marketing("false");
 		expect(redirectedTo(await proxy(request("/")))).toBe("/sign-in");