diff --git a/home/pi/pivilion/config/html/.htaccess b/home/pi/pivilion/config/html/.htaccess
index 1a1eb29..10920cb 100644
--- a/home/pi/pivilion/config/html/.htaccess
+++ b/home/pi/pivilion/config/html/.htaccess
@@ -1,11 +1,9 @@
 RewriteEngine on
 
-# Captive-network probes use otherwise unknown paths such as /generate_204,
-# /hotspot-detect.html, and /connecttest.txt. Redirect those temporarily so
-# clients open their login assistant, but let the gallery serve its own PHP and
-# asset paths without a loop.
-RewriteCond %{REQUEST_URI} !\.php$ [NC]
-RewriteCond %{REQUEST_URI} !\.head(?:\.|$) [NC]
-RewriteCond %{REQUEST_URI} !^/(?:content|css|doc|docker|img|images|js|modules|tests|upload)(?:/|$) [NC]
-RewriteCond %{REQUEST_URI} !^/pi-logo_128\.png$ [NC]
-RewriteRule ^ http://10.1.1.1/index.php [L,R=302,NE]
+# Serve every existing gallery file or directory without rewriting.
+RewriteCond %{REQUEST_FILENAME} -f [OR]
+RewriteCond %{REQUEST_FILENAME} -d
+RewriteRule ^ - [END]
+
+# Redirect only unknown captive-network probe paths.
+RewriteRule ^ http://10.1.1.1/index.php [END,R=302,NE]
diff --git a/tests/run.sh b/tests/run.sh
index 223ec42..85af2d6 100755
--- a/tests/run.sh
+++ b/tests/run.sh
@@ -28,7 +28,10 @@ systemd_syntax() {
 }
 
 captive_rules() {
-    grep -q 'R=302' "$ROOT/home/pi/pivilion/config/html/.htaccess" &&
+    grep -Fqx 'RewriteCond %{REQUEST_FILENAME} -f [OR]' "$ROOT/home/pi/pivilion/config/html/.htaccess" &&
+        grep -Fqx 'RewriteCond %{REQUEST_FILENAME} -d' "$ROOT/home/pi/pivilion/config/html/.htaccess" &&
+        grep -Fqx 'RewriteRule ^ - [END]' "$ROOT/home/pi/pivilion/config/html/.htaccess" &&
+        grep -q 'R=302' "$ROOT/home/pi/pivilion/config/html/.htaccess" &&
         ! grep -q 'R=301' "$ROOT/home/pi/pivilion/config/html/.htaccess" &&
         ! grep -Eq 'dport[[:space:]]+443|redirect to :443' "$ROOT/usr/local/lib/pivilion/mode.sh"
 }