diff --git a/src/app/login/page.tsx b/src/app/login/page.tsx
index 601170c..0348241 100644
--- a/src/app/login/page.tsx
+++ b/src/app/login/page.tsx
@@ -2,12 +2,11 @@
 
 import React, { useState, Suspense } from 'react';
 import Image from 'next/image';
-import { useRouter, useSearchParams } from 'next/navigation';
+import { useSearchParams } from 'next/navigation';
 import { createClient } from '@/lib/supabase/client';
 import { Mail, Lock, Eye, EyeOff, ShieldCheck, ArrowRight, Loader2 } from 'lucide-react';
 
 function LoginForm() {
-  const router = useRouter();
   const searchParams = useSearchParams();
   const next = searchParams.get('next') || '/dashboard/kpis';
 
@@ -36,9 +35,15 @@ function LoginForm() {
       }
 
       if (data.session) {
-        router.push(next);
-        router.refresh();
+        // Hard navigation so middleware always sees the fresh auth cookie.
+        const dest =
+          next.startsWith('/') && !next.startsWith('//') ? next : '/dashboard/kpis';
+        window.location.assign(dest);
+        return;
       }
+
+      setErrorMsg('No se pudo crear la sesión. Inténtalo de nuevo.');
+      setLoading(false);
     } catch (err: any) {
       setErrorMsg(
         err?.message || 'Error de conexión con el servidor de autenticación.'
diff --git a/src/lib/supabase/server.ts b/src/lib/supabase/server.ts
index 2f4516d..cec89f1 100644
--- a/src/lib/supabase/server.ts
+++ b/src/lib/supabase/server.ts
@@ -7,22 +7,6 @@ export async function createClient() {
     process.env.NEXT_PUBLIC_SUPABASE_URL!,
     process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
     {
-      global: {
-        fetch: (url: string | URL | Request, options?: RequestInit) => {
-          const u = new URL(url.toString());
-          if (process.env.NODE_ENV === 'production' && u.hostname === 'supabase.4ventures.es') {
-            u.protocol = 'http:';
-            u.hostname = 'ventures-web-supabase-gm0nnn-supabase-kong';
-            u.port = '8000';
-            if (!options) options = {};
-            if (!options.headers) options.headers = new Headers();
-            const headers = new Headers(options.headers);
-            headers.set('Host', 'supabase.4ventures.es');
-            options.headers = headers;
-          }
-          return fetch(u.toString(), options);
-        }
-      },
       cookies: {
         getAll() {
           return cookieStore.getAll();
diff --git a/src/middleware.ts b/src/middleware.ts
index f85331e..bb34766 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -1,11 +1,13 @@
 import { createServerClient } from '@supabase/ssr';
 import { NextRequest, NextResponse } from 'next/server';
 
-function withSecurityHeaders(res: NextResponse) {
+function withSecurityHeaders(res: NextResponse, path?: string) {
   res.headers.set('X-Frame-Options', 'DENY');
   res.headers.set('X-Content-Type-Options', 'nosniff');
   res.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
-  res.headers.set('X-Robots-Tag', 'noindex, nofollow');
+  if (!path?.startsWith('/legal')) {
+    res.headers.set('X-Robots-Tag', 'noindex, nofollow');
+  }
   res.headers.set(
     'Permissions-Policy',
     'camera=(), microphone=(), geolocation=()'
@@ -24,26 +26,12 @@ export async function middleware(req: NextRequest) {
     request: { headers: req.headers },
   });
 
+  // Public Supabase URL only — Docker-internal Kong rewrite made getUser() fail
+  // after login (cookie set, middleware treats user as logged out → stuck verifying).
   const supabase = createServerClient(
     process.env.NEXT_PUBLIC_SUPABASE_URL!,
     process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
     {
-      global: {
-        fetch: (url: string | URL | Request, options?: RequestInit) => {
-          const u = new URL(url.toString());
-          if (process.env.NODE_ENV === 'production' && u.hostname === 'supabase.4ventures.es') {
-            u.protocol = 'http:';
-            u.hostname = 'ventures-web-supabase-gm0nnn-supabase-kong';
-            u.port = '8000';
-            if (!options) options = {};
-            if (!options.headers) options.headers = new Headers();
-            const headers = new Headers(options.headers);
-            headers.set('Host', 'supabase.4ventures.es');
-            options.headers = headers;
-          }
-          return fetch(u.toString(), options);
-        }
-      },
       cookies: {
         getAll() {
           return req.cookies.getAll();