diff --git a/lib/supabase/__tests__/middleware.test.ts b/lib/supabase/__tests__/middleware.test.ts
index c755a9a4..fdb7b484 100644
--- a/lib/supabase/__tests__/middleware.test.ts
+++ b/lib/supabase/__tests__/middleware.test.ts
@@ -249,6 +249,32 @@ describe('updateSession redirect destinations', () => {
     })
   })
 
+  // ── Public agent-discovery + docs surfaces ────────────────────────────
+
+  describe('anonymous access to agent-discovery and docs surfaces', () => {
+    it.each(['/llms.txt', '/llms-full.txt', '/docs/api', '/docs/api.md', '/docs/api/reference.md', '/docs/api/cookbook/quickstart.md'])(
+      'serves %s without a login bounce',
+      async (path) => {
+        const response = await run(path)
+        expect(response.status).not.toBe(307)
+        expect(locationOf(response)).toBeNull()
+      },
+    )
+
+    it('does not treat a /docs prefix on another route as public', async () => {
+      // /docsy-dashboard must still bounce: only /docs and /docs/* are public.
+      const response = await run('/docsy-dashboard')
+      expect(response.status).toBe(307)
+      expect(new URL(locationOf(response)!).pathname).toBe('/login')
+    })
+
+    it('serves docs to a signed-in user without redirecting away', async () => {
+      state.user = SIGNED_IN
+      const response = await run('/docs/api')
+      expect(response.status).not.toBe(307)
+    })
+  })
+
   // ── Site 1: protected-route bounce ────────────────────────────────────
 
   describe('protected route bounce to /login', () => {
diff --git a/lib/supabase/middleware.ts b/lib/supabase/middleware.ts
index 5b638f30..99b528c3 100644
--- a/lib/supabase/middleware.ts
+++ b/lib/supabase/middleware.ts
@@ -201,6 +201,23 @@ export async function updateSession(request: NextRequest) {
     return supabaseResponse
   }
 
+  // Public agent-discovery + API docs surfaces. /llms.txt and /llms-full.txt
+  // exist FOR anonymous consumers (the llms.txt convention targets logged-out
+  // crawlers and IDE agents), and /docs is the public API documentation the
+  // OpenAPI spec and the installable accounted-api skill link to. None of it
+  // reads the session. Without this branch every anonymous hit 307-bounced to
+  // /login, which silently broke agent discovery on the hosted product
+  // (openapi.json only escaped because the proxy matcher skips .json paths).
+  // Logged-in users fall through to the same content: no redirect either way.
+  if (
+    pathname === '/llms.txt' ||
+    pathname === '/llms-full.txt' ||
+    pathname === '/docs' ||
+    pathname.startsWith('/docs/')
+  ) {
+    return supabaseResponse
+  }
+
   // Public auth routes: allow access
   if (
     pathname.startsWith('/login') ||