diff --git a/infra/coredns/hosts b/infra/coredns/hosts
index 8518f2f..2cb40d6 100644
--- a/infra/coredns/hosts
+++ b/infra/coredns/hosts
@@ -20,3 +20,4 @@
 192.168.1.192 bcda.fhirworx.io
 192.168.1.192 lead.fhirworx.io
 192.168.1.192 reach.fhirworx.io
+192.168.1.192 lex.fhirworx.io
diff --git a/infra/nginx/index.html b/infra/nginx/index.html
index fd25e8a..859fca3 100644
--- a/infra/nginx/index.html
+++ b/infra/nginx/index.html
@@ -93,6 +93,16 @@
                 <div class="stripe"></div>
             </a>
 
+            <a data-subdomain="lex" target="_blank" class="tile notebook">
+                <span class="icon" aria-hidden="true"><svg><use href="#i-chart-area-line"/></svg></span>
+                <div class="tile-eyebrow">LEX</div>
+                <div class="tile-title">Code-family dossiers</div>
+                <p class="tile-desc">Legal-epidemiology workbench for CMS payment and quality rules</p>
+                <span class="health health-unknown"><span class="health-k">health</span><span class="health-v">checking</span></span>
+                <span class="tile-port"></span>
+                <div class="stripe"></div>
+            </a>
+
             <a data-subdomain="traefik" target="_blank" class="tile proxy">
                 <span class="icon" aria-hidden="true"><svg><use href="#i-route"/></svg></span>
                 <div class="tile-eyebrow">Networking</div>
diff --git a/infra/nginx/nginx.conf b/infra/nginx/nginx.conf
index ee1fa4c..860695f 100644
--- a/infra/nginx/nginx.conf
+++ b/infra/nginx/nginx.conf
@@ -41,6 +41,7 @@ http {
         location = /healthz/bcda       { set $up bcda:8501;       rewrite ^ /_stcore/health break;      proxy_pass http://$up; include /etc/nginx/healthz-headers.conf; }
         location = /healthz/lead       { set $up lead:8501;       rewrite ^ /_stcore/health break;      proxy_pass http://$up; include /etc/nginx/healthz-headers.conf; }
         location = /healthz/reach      { set $up lead:8501;       rewrite ^ /_stcore/health break;      proxy_pass http://$up; include /etc/nginx/healthz-headers.conf; }
+        location = /healthz/lex        { set $up git:3000;        rewrite ^ /assets/dossier/index.html break; proxy_pass http://$up; include /etc/nginx/healthz-headers.conf; }
         location = /healthz/traefik    { set $up traefik:8080;    rewrite ^ /api/version break;         proxy_pass http://$up; include /etc/nginx/healthz-headers.conf; }
         location = /healthz/s3console  { set $up rustfs:9001;     rewrite ^ /health break;              proxy_pass http://$up; include /etc/nginx/healthz-headers.conf; }
         location = /healthz/git        { set $up git:3000;        rewrite ^ /api/healthz break;         proxy_pass http://$up; include /etc/nginx/healthz-headers.conf; }
diff --git a/infra/traefik/dynamic/services.yml b/infra/traefik/dynamic/services.yml
index 6178b6d..7209311 100644
--- a/infra/traefik/dynamic/services.yml
+++ b/infra/traefik/dynamic/services.yml
@@ -22,6 +22,7 @@
   "rustfs-api"         (dict "container" "rustfs" "port" "9000" "subdomain" "s3"        "theme" false "mw" "git-sso,infra-headers")
   "rustfs-console"     (dict "container" "rustfs" "port" "9001" "subdomain" "s3console" "theme" true  "mw" "git-sso,infra-headers")
   "reach"              (dict "container" "lead"  "port" "8501" "subdomain" "reach"     "theme" false "mw" "git-sso,secure-headers")
+  "lex"                (dict "container" "git"   "port" "3000" "subdomain" "lex"       "theme" false "mw" "git-sso,lex-page,dossier-nocache,secure-headers")
 -}}
 http:
   middlewares:
@@ -68,10 +69,12 @@ http:
       headers:
         customResponseHeaders:
           Cache-Control: "no-cache"
-    # lex.<domain> (the dossier app): "/" is the static page Gitea serves.
+    # lex.<domain> (the dossier app): every path serves the static page Gitea
+    # holds in custom/public, so Gitea's own pages never appear on lex.
     lex-page:
-      replacePath:
-        path: "/assets/dossier/index.html"
+      replacePathRegex:
+        regex: "^/.*$"
+        replacement: "/assets/dossier/index.html"
     # Anything else on lex, and the old git.<domain>/dossier address, goes
     # to the lex root. Matches every URL, so these routers never fall
     # through to a service.
@@ -181,74 +184,6 @@ http:
         - git-sso
         - dossier-nocache
         - secure-headers
-    # lex.<domain>: the dossier app (legal-epidemiology workbench). Only "/"
-    # and /assets/dossier/ reach Gitea; every other path redirects to "/"
-    # through noop@internal, so Gitea's own pages never appear on lex.
-    lex:
-      rule: "Host(`lex.{{ $domain }}`) && Path(`/`)"
-      priority: 1000
-      service: git
-      entryPoints:
-        - web
-      middlewares:
-        - git-sso
-        - lex-page
-        - dossier-nocache
-        - secure-headers
-    lex-tls:
-      rule: "Host(`lex.{{ $domain }}`) && Path(`/`)"
-      priority: 1000
-      service: git
-      entryPoints:
-        - websecure
-      tls: {}
-      middlewares:
-        - git-sso
-        - lex-page
-        - dossier-nocache
-        - secure-headers
-    lex-assets:
-      rule: "Host(`lex.{{ $domain }}`) && PathPrefix(`/assets/dossier/`)"
-      priority: 1000
-      service: git
-      entryPoints:
-        - web
-      middlewares:
-        - git-sso
-        - dossier-nocache
-        - secure-headers
-    lex-assets-tls:
-      rule: "Host(`lex.{{ $domain }}`) && PathPrefix(`/assets/dossier/`)"
-      priority: 1000
-      service: git
-      entryPoints:
-        - websecure
-      tls: {}
-      middlewares:
-        - git-sso
-        - dossier-nocache
-        - secure-headers
-    lex-other:
-      rule: "Host(`lex.{{ $domain }}`)"
-      priority: 10
-      service: noop@internal
-      entryPoints:
-        - web
-      middlewares:
-        - git-sso
-        - to-lex
-        - secure-headers
-    lex-other-tls:
-      rule: "Host(`lex.{{ $domain }}`)"
-      priority: 10
-      service: noop@internal
-      entryPoints:
-        - websecure
-      tls: {}
-      middlewares:
-        - git-sso
-        - to-lex
-        - secure-headers
     {{- range $name, $svc := $reef }}
     {{ $name }}:
       rule: "Host(`{{ get $svc "subdomain" | default $name }}.{{ $domain }}`){{ range get $svc "extra_hosts" | default list }} || Host(`{{ . }}`){{ end }}"
diff --git a/stack.toml b/stack.toml
index 15aeb93..51ba07b 100644
--- a/stack.toml
+++ b/stack.toml
@@ -24,7 +24,7 @@ subdomains = [
     "dashboard", "docs", "git", "ci", "notebooks", "zotero",
     "webdav", "api", "nessie", "trino", "polaris",
     "grafana", "prometheus", "tempo", "loki",
-    "s3", "s3console", "llm", "bcda", "lead", "reach",
+    "s3", "s3console", "llm", "bcda", "lead", "reach", "lex",
 ]
 
 [services]