diff --git a/scripts/generate-caddyfile.sh b/scripts/generate-caddyfile.sh
index 574aaaa..1a0dd05 100755
--- a/scripts/generate-caddyfile.sh
+++ b/scripts/generate-caddyfile.sh
@@ -362,6 +362,10 @@ EOF_CADDY
         respond "Gitea gateway OK" 200
     }
 
+    handle /api/internal/* {
+        respond "Forbidden" 403
+    }
+
     handle {
         reverse_proxy appfactory-gitea:3000
     }