diff --git a/frontend/app/api/auth/me/route.ts b/frontend/app/api/auth/me/route.ts
index e63ad8c5..a0b9d449 100644
--- a/frontend/app/api/auth/me/route.ts
+++ b/frontend/app/api/auth/me/route.ts
@@ -20,6 +20,14 @@ export async function GET(req: NextRequest) {
       headers: auth.headers,
       cache: "no-store",
     });
+    if (res.status === 401 || res.status === 403) {
+      const response = NextResponse.json({
+        authenticated: false,
+        subscription_active: false,
+        points: 0,
+      });
+      return applyAuthResponseCookies(response, auth.response);
+    }
     if (!res.ok) {
       const raw = await res.text();
       const response = NextResponse.json(
diff --git a/frontend/middleware.ts b/frontend/middleware.ts
index cd1c41dd..22ea07ec 100644
--- a/frontend/middleware.ts
+++ b/frontend/middleware.ts
@@ -47,7 +47,13 @@ function isPublicPage(pathname: string) {
 }
 
 function isPublicApi(pathname: string) {
-  return pathname === "/api/cities" || /^\/api\/city\/[^/]+\/summary$/i.test(pathname);
+  return (
+    pathname === "/api/auth/me" ||
+    pathname === "/api/cities" ||
+    pathname === "/api/vitals" ||
+    /^\/api\/city\/[^/]+$/i.test(pathname) ||
+    /^\/api\/city\/[^/]+\/summary$/i.test(pathname)
+  );
 }
 
 function handleLegacyTokenGate(request: NextRequest) {