diff --git a/ui/src/sw.js b/ui/src/sw.js
index 2096874cd..4b8de49f2 100644
--- a/ui/src/sw.js
+++ b/ui/src/sw.js
@@ -1,34 +1,31 @@
 /// <reference lib="webworker" />
 import { clientsClaim } from 'workbox-core'
-import { cleanupOutdatedCaches, createHandlerBoundToURL, precacheAndRoute } from 'workbox-precaching'
+import { cleanupOutdatedCaches, matchPrecache, precacheAndRoute } from 'workbox-precaching'
 import { NavigationRoute, registerRoute } from 'workbox-routing'
 
-// self.__WB_MANIFEST is the default injection point
-precacheAndRoute(self.__WB_MANIFEST)
+// directoryIndex/cleanURLs off so the precache doesn't serve a /dashboard/ navigation from cache - the route below owns navigations
+precacheAndRoute(self.__WB_MANIFEST, {
+    directoryIndex: null,
+    cleanURLs: false
+})
 
 // clean old assets
 cleanupOutdatedCaches()
 
-/** @type {RegExp[] | undefined} */
-const denylist = []
+const NETWORK_TIMEOUT_MS = 5000
 
-// in dev mode, do not precache anything
-if (import.meta.env.DEV) {
-    // don't precache anything
-    console.log('Development mode, not pre-caching anything')
-    denylist.push(/.*/)
-} else {
-    // don't precache anything where the urls pathname ends with a slash (including times when the url has a query string)
-    // this permits the request to be handled by the server which will do a redirect as required
-    const configPath = self.location.pathname.split('/')[1]
-    denylist.push(new RegExp(`/${configPath}/[^?]*/(\\?.*)*$`))
-}
-
-// to allow work offline for allowed routes only
-registerRoute(new NavigationRoute(
-    createHandlerBoundToURL('index.html'),
-    { denylist }
-))
+// Network-first so an auth proxy's login redirect is followed - cached shell as offline fallback
+registerRoute(new NavigationRoute(async ({ request }) => {
+    const controller = new AbortController()
+    const timeout = setTimeout(() => controller.abort(), NETWORK_TIMEOUT_MS)
+    try {
+        return await fetch(request, { signal: controller.signal })
+    } catch {
+        return (await matchPrecache('index.html')) || Response.error()
+    } finally {
+        clearTimeout(timeout)
+    }
+}))
 
 self.skipWaiting()
 // https://developer.mozilla.org/en-US/docs/Web/API/Clients/claim
diff --git a/vite.config.js b/vite.config.js
index e0ce35fc0..0e2d94816 100644
--- a/vite.config.js
+++ b/vite.config.js
@@ -32,7 +32,7 @@ export default defineConfig({
 
             injectManifest: {
                 maximumFileSizeToCacheInBytes: process.env.NODE_ENV === 'development' ? 6000000 : 3350000,
-                globPatterns: ['**/*.{js,css,html,svg,png,ico,ttf,eot,woff,woff2}']
+                globPatterns: process.env.NODE_ENV === 'development' ? [] : ['**/*.{js,css,html,svg,png,ico,ttf,eot,woff,woff2}']
             },
 
             devOptions: {