diff --git a/build.sh b/build.sh
index 8311b1c..d2e7df3 100755
--- a/build.sh
+++ b/build.sh
@@ -68,6 +68,8 @@ fi
 for m in rag-pipeline; do
     [ -d pkgs/$m/wwwroot ] && ln -sf ../pkgs/$m/wwwroot wwwroot/$m 2>/dev/null || true
 done
+# Always symlink rbac wwwroot for login pages
+ln -sf ../pkgs/rbac/wwwroot wwwroot/rbac 2>/dev/null || true
 
 # Fix created_by in CRUD dspy files
 if [ -d wwwroot/knowledge_bases_list ]; then
diff --git a/scripts/init_rbac.py b/scripts/init_rbac.py
index e798c69..9e1bd13 100644
--- a/scripts/init_rbac.py
+++ b/scripts/init_rbac.py
@@ -10,7 +10,10 @@ from appPublic.jsonConfig import getConfig
 config = getConfig('.')
 DBPools(config.databases)
 
-PUBLIC = ['/api/status', '/api/engines', '/api/kb/list', '/', '/index.ui', '/bricks/**']
+PUBLIC = ['/api/status', '/api/engines', '/api/kb/list', '/', '/index.ui', '/bricks/**',
+          '/rbac/user/login.ui', '/rbac/user/register.ui',
+          '/rbac/user/login.dspy', '/rbac/user/register.dspy', '/rbac/user/logout.dspy',
+          '/rbac/**']
 LOGINED = ['/api/search', '/api/ingest',
            '/knowledge_bases_list/', '/documents_list/',
            '/engine_configs_list/', '/subscriptions_list/']