diff --git a/nodes/heimdall/vscode/compose.yaml b/nodes/heimdall/vscode/compose.yaml
index 364f954..44ab19c 100644
--- a/nodes/heimdall/vscode/compose.yaml
+++ b/nodes/heimdall/vscode/compose.yaml
@@ -1,24 +1,21 @@
 services:
   vscode:
-    image: lscr.io/linuxserver/code-server:latest #4.115.0-ls332
+    image: lscr.io/linuxserver/code-server:latest
     container_name: vscode
     environment:
       - PUID=1000
       - PGID=1000
       - TZ=Etc/UTC
-      - PASSWORD=Procmi*1 #optional
-      - HASHED_PASSWORD= #optional
-      - SUDO_PASSWORD=password #optional
-      - SUDO_PASSWORD_HASH= #optional
-      - PROXY_DOMAIN=code.castaldifamily.com #optional
-      - DEFAULT_WORKSPACE=/config/workspace #optional
-      - PWA_APPNAME=vscode #optional
+      # --- AUTH CHANGE ---
+      - AUTH=none            # Tell code-server to skip its own password prompt
+      - SUDO_PASSWORD=password 
+      - PROXY_DOMAIN=code.castaldifamily.com 
+      - DEFAULT_WORKSPACE=/config/workspace 
+      - PWA_APPNAME=vscode 
     volumes:
       - /mnt/appdata/vscode/data:/config
     networks:
       - proxy-net
-    ports:
-      - 8443:8443
     restart: unless-stopped
     labels:
       - "traefik.enable=true"
@@ -27,7 +24,43 @@ services:
       - "traefik.http.routers.vscode.tls=true"
       - "traefik.http.routers.vscode.tls.certresolver=cloudflare"
       - "traefik.http.services.vscode.loadbalancer.server.port=8443"
+      # --- THE BOUNCER ---
+      - "traefik.http.routers.vscode.middlewares=security-headers@file,authentik-auth@file"
 
 networks:
   proxy-net:
-    external: true
\ No newline at end of file
+    external: true
+
+# services:
+#   vscode:
+#     image: lscr.io/linuxserver/code-server:latest #4.115.0-ls332
+#     container_name: vscode
+#     environment:
+#       - PUID=1000
+#       - PGID=1000
+#       - TZ=Etc/UTC
+#       - PASSWORD=Procmi*1 #optional
+#       - HASHED_PASSWORD= #optional
+#       - SUDO_PASSWORD=password #optional
+#       - SUDO_PASSWORD_HASH= #optional
+#       - PROXY_DOMAIN=code.castaldifamily.com #optional
+#       - DEFAULT_WORKSPACE=/config/workspace #optional
+#       - PWA_APPNAME=vscode #optional
+#     volumes:
+#       - /mnt/appdata/vscode/data:/config
+#     networks:
+#       - proxy-net
+#     ports:
+#       - 8443:8443
+#     restart: unless-stopped
+#     labels:
+#       - "traefik.enable=true"
+#       - "traefik.http.routers.vscode.entrypoints=websecure"
+#       - "traefik.http.routers.vscode.rule=Host(`code.castaldifamily.com`)"
+#       - "traefik.http.routers.vscode.tls=true"
+#       - "traefik.http.routers.vscode.tls.certresolver=cloudflare"
+#       - "traefik.http.services.vscode.loadbalancer.server.port=8443"
+
+# networks:
+#   proxy-net:
+#     external: true
\ No newline at end of file