diff --git a/kustomize/config/vcell-ai-local/litellm.env b/kustomize/config/vcell-ai-local/litellm.env
index 98ccfc1..1d511aa 100644
--- a/kustomize/config/vcell-ai-local/litellm.env
+++ b/kustomize/config/vcell-ai-local/litellm.env
@@ -14,3 +14,6 @@ LOCAL_LLM_API_BASE=http://ollama:11434
 
 # Langfuse tracing callback (host only; keys are secret)
 LANGFUSE_HOST=https://cloud.langfuse.com
+
+# SERVER_ROOT_PATH: set this only if the proxy is exposed under a URL prefix
+# (dev serves it at /kartik). Local reaches it directly, so leave it unset.
diff --git a/kustomize/config/vcell-ai-rke-dev/litellm.env b/kustomize/config/vcell-ai-rke-dev/litellm.env
index 7353177..0fbb546 100644
--- a/kustomize/config/vcell-ai-rke-dev/litellm.env
+++ b/kustomize/config/vcell-ai-rke-dev/litellm.env
@@ -14,3 +14,12 @@ LOCAL_LLM_API_BASE=http://ollama:11434
 
 # Langfuse tracing callback (host only; keys are secret)
 LANGFUSE_HOST=https://cloud.langfuse.com
+
+# This proxy is exposed through the shared host at /kartik (see the dev
+# ingress). Tell LiteLLM so it builds prefix-aware URLs -- without this its
+# admin UI redirects to an absolute /ui/, which escapes the prefix and lands on
+# the Next.js frontend instead. Passed to FastAPI as root_path, which is the
+# "reverse proxy strips the prefix" contract, so it matches the ingress
+# rewrite-target and does NOT change route matching: the backend's in-cluster
+# calls to http://litellm:4000/v1/... keep working unprefixed.
+SERVER_ROOT_PATH=/kartik
diff --git a/kustomize/config/vcell-ai-rke/litellm.env b/kustomize/config/vcell-ai-rke/litellm.env
index 62eff79..ed878ef 100644
--- a/kustomize/config/vcell-ai-rke/litellm.env
+++ b/kustomize/config/vcell-ai-rke/litellm.env
@@ -14,3 +14,7 @@ LOCAL_LLM_API_BASE=http://ollama:11434
 
 # Langfuse tracing callback (host only; keys are secret)
 LANGFUSE_HOST=https://cloud.langfuse.com
+
+# SERVER_ROOT_PATH: set this only if the proxy is exposed under a URL prefix
+# (dev serves it at /kartik). Prod does not expose LiteLLM through the ingress,
+# so leave it unset -- it defaults to "" and the UI/redirects stay at the root.