diff --git a/package.json b/package.json
index 30b4ac0..f82d549 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "siteforge",
   "private": true,
-  "version": "1.1.30",
+  "version": "1.1.31",
   "type": "module",
   "scripts": {
     "dev": "vite",
diff --git a/vite.config.ts b/vite.config.ts
index a54f83c..d07d5fe 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -23,7 +23,15 @@ export default defineConfig({
       },
       workbox: {
         navigateFallback: '/index.html',
-        navigateFallbackDenylist: [/^\/api\//, /^\/feed\.xml/, /^\/uploads\//],
+        // Allowlist-only approach: SW only serves index.html for known SPA routes.
+        // Everything else (admin-configured redirects, /spotify, /apple, /amazon,
+        // feed.xml, robots.txt, etc.) goes to the server so server-side redirects work.
+        navigateFallbackAllowlist: [
+          /^\/$/, // exact root
+          /^\/(start-here|about|contact|resources|thanks|preview|privacy|terms|salvation)(\/.*)?$/,
+          /^\/(study|studys|episodes|finished|downloads|subscribe|certificate)(\/.*)?$/,
+          /^\/(questions|admin|email|contacts|calendar)(\/.*)?$/,
+        ],
         runtimeCaching: [
           {
             urlPattern: /^\/api\/(episodes|questions)/,