diff --git a/routes/web.php b/routes/web.php
index d540e32..749eef8 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -24,6 +24,17 @@ Route::get('/', function () {
     return redirect('/admin');
 });
 
+// Stub `login` route — needed because Laravel's auth middleware tries to
+// route('login') when redirecting unauthenticated requests. We don't have a
+// global /login (panels use /admin/login and /app/login), so stub it.
+Route::get('/login', function (Request $request) {
+    if ($request->expectsJson() || $request->is('api/*')) {
+        return response()->json(['message' => 'Unauthenticated.'], 401);
+    }
+    $tenant = app(TenantManager::class)->current();
+    return redirect($tenant ? '/app/login' : '/admin/login');
+})->name('login');
+
 // Locale switch — POST /locale/{lang} sets session and persists to user.
 Route::post('/locale/{lang}', function (Request $request, string $lang) {
     if (! in_array($lang, ['ro', 'ru', 'en'], true)) {