diff --git a/src/middleware.ts b/src/middleware.ts
index 4ba9be3..3ea66d8 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -14,23 +14,28 @@ function isProtected(path: string): boolean {
 
 export async function middleware(req: NextRequest) {
   const host = (req.headers.get("host") || "").toLowerCase();
-  if (host.startsWith("it.sam.") && req.nextUrl.pathname === "/") {
-    const url = req.nextUrl.clone();
-    url.pathname = "/tablero";
-    return NextResponse.rewrite(url);
-  }
   if (req.nextUrl.pathname === "/m/portal" || req.nextUrl.pathname.startsWith("/m/portal/")) {
     return NextResponse.redirect(IT_BOARD);
   }
-  if (isProtected(req.nextUrl.pathname)) {
+  // it.sam/ equivale a /tablero (protegido): se evalúa con ese path
+  const effective =
+    host.startsWith("it.sam.") && req.nextUrl.pathname === "/"
+      ? "/tablero"
+      : req.nextUrl.pathname;
+  if (isProtected(effective)) {
     const sess = await readSession(req.cookies.get(COOKIE)?.value);
     if (!sess) {
       const url = req.nextUrl.clone();
       url.pathname = "/login";
-      url.searchParams.set("next", req.nextUrl.pathname);
+      url.searchParams.set("next", effective);
       return NextResponse.redirect(url);
     }
   }
+  if (effective !== req.nextUrl.pathname) {
+    const url = req.nextUrl.clone();
+    url.pathname = effective;
+    return NextResponse.rewrite(url);
+  }
   return NextResponse.next();
 }