diff --git a/joal/rootfs/etc/nginx/servers/ingress.conf b/joal/rootfs/etc/nginx/servers/ingress.conf
index eac43b228..6648edce2 100644
--- a/joal/rootfs/etc/nginx/servers/ingress.conf
+++ b/joal/rootfs/etc/nginx/servers/ingress.conf
@@ -1,26 +1,40 @@
-
 server {
-    listen %%interface%%:%%port%% default_server;
+  listen %%interface%%:%%port%% default_server;
 
-    include /etc/nginx/includes/server_params.conf;
-    include /etc/nginx/includes/proxy_params.conf;
-    
-    client_max_body_size 0;
+  include /etc/nginx/includes/server_params.conf;
+  include /etc/nginx/includes/proxy_params.conf;
 
-   location / {
-       add_header Access-Control-Allow-Origin *;
-       proxy_connect_timeout 30m;
-       proxy_send_timeout 30m;
-       proxy_read_timeout 30m;
-       proxy_pass         http://backend/%%path%%/ui/;
+  client_max_body_size 0;
+
+  # When user opens the ingress root, redirect to the JOAL UI with credentials prefilled
+  location = / {
+    return 302 /%%path%%/ui/?ui_credentials=%%ui_credentials%%;
   }
 
-    location /:8123/ {
-       add_header Access-Control-Allow-Origin *;
-       proxy_connect_timeout 30m;
-       proxy_send_timeout 30m;
-       proxy_read_timeout 30m;
-       proxy_pass       http://backend/;
+  # (Optional but helpful) /joal -> /joal/
+  location = /%%path%% {
+    return 302 /%%path%%/;
   }
 
+  # Proxy everything under the JOAL path prefix to the backend, preserving paths
+  location /%%path%%/ {
+    add_header Access-Control-Allow-Origin *;
+
+    proxy_connect_timeout 30m;
+    proxy_send_timeout 30m;
+    proxy_read_timeout 30m;
+
+    proxy_pass http://backend/%%path%%/;
+  }
+
+  # Special virtual "port tunnel" used by JOAL UI (it encodes :8123 into the path)
+  location /:8123/ {
+    add_header Access-Control-Allow-Origin *;
+
+    proxy_connect_timeout 30m;
+    proxy_send_timeout 30m;
+    proxy_read_timeout 30m;
+
+    proxy_pass http://backend/;
+  }
 }