diff --git a/src/middleware.ts b/src/middleware.ts
index 153cb28..a2244ba 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -15,6 +15,14 @@ import { AUTH_COOKIE } from "@/lib/auth/cookie";
 export function middleware(request: NextRequest) {
   const hasAuth = request.cookies.has(AUTH_COOKIE);
 
+  // Public intake links have no session. The token IS the authentication,
+  // and the route's own checks enforce it. A redirect here would lock every
+  // visitor out of the wizard, so /intake/:path* is the one path the
+  // cookie check is allowed to ignore.
+  if (request.nextUrl.pathname.startsWith("/intake/")) {
+    return NextResponse.next();
+  }
+
   if (!hasAuth) {
     const url = request.nextUrl.clone();
     url.pathname = "/login";