diff --git a/packages/engine/src/index.ts b/packages/engine/src/index.ts
index 18895f0..fca7371 100644
--- a/packages/engine/src/index.ts
+++ b/packages/engine/src/index.ts
@@ -117,6 +117,10 @@ app.use('*', async (c, next) => {
 // UI (no auth, served before auth middleware)
 // ============================================
 
+app.get('/favicon.ico', (c) => {
+  return new Response(null, { status: 204 })
+})
+
 app.get('/ui', (c) => {
   return c.html(UI_HTML)
 })
@@ -143,7 +147,7 @@ app.get('/schema', async (c) => {
 
 // Auth middleware for all routes except health, schema, ui, and POST /events (which has its own dual auth)
 app.use('*', async (c, next) => {
-  if (c.req.path === '/health' || c.req.path === '/schema' || c.req.path.startsWith('/ui')) return next()
+  if (c.req.path === '/health' || c.req.path === '/schema' || c.req.path === '/favicon.ico' || c.req.path.startsWith('/ui')) return next()
   if (c.req.method === 'POST' && c.req.path === '/events') return next()
   return bearerAuth(c.env.API_TOKEN)(c, next)
 })