diff --git a/static.go b/static.go
index d75d79a..4fbd1b7 100644
--- a/static.go
+++ b/static.go
@@ -38,9 +38,11 @@ const defaultAdminPath = "/bmadmin"
 
 // reservedPrefixes are the path prefixes the student app never answers: the
 // APIs of the plugins (the chat plugins' included), the public uploads and
-// /oauth (the social sign-in routes of golem15.sociallogin and their
-// provider callbacks). The admin path is added from the configuration.
-var reservedPrefixes = []string{"/_user", "/_bm", "/_quizzes", "/_presentations", "/_chat", "/_chatchannels", "/_chatbots", "/api", "/storage", "/oauth"}
+// /oauth (the social sign-in routes of golem15.sociallogin, their provider
+// callbacks and golem15.oauthserver's MCP authorization routes), /mcp (the
+// MCP endpoint) and /.well-known (the OAuth metadata documents). The admin
+// path is added from the configuration.
+var reservedPrefixes = []string{"/_user", "/_bm", "/_quizzes", "/_presentations", "/_chat", "/_chatchannels", "/_chatbots", "/api", "/storage", "/oauth", "/mcp", "/.well-known"}
 
 // errMissingIndex reports a tree without index.html (an unbuilt tree).
 var errMissingIndex = errors.New("jz.bm: public/index.html missing; run the frontend build (cd frontend && npm ci && npm run build)")