diff --git a/charts/eoapi/profiles/experimental.yaml b/charts/eoapi/profiles/experimental.yaml
index cf8b2c9c..4ed040ce 100644
--- a/charts/eoapi/profiles/experimental.yaml
+++ b/charts/eoapi/profiles/experimental.yaml
@@ -331,8 +331,6 @@ ingress:
 
 stac-auth-proxy:
   enabled: true
-  image:
-    tag: "v1.1.0"
   # For testing this will be set dynamically; for production, point to your OIDC server
   env:
     # OIDC_DISCOVERY_URL: "http://eoapi-mock-oidc-server.eoapi.svc.cluster.local:8080/.well-known/openid-configuration"
@@ -354,28 +352,6 @@ stac-auth-proxy:
       subPath: custom_filters.py
       readOnly: true
 
-  # Override health check paths to include ROOT_PATH
-  startupProbe:
-    httpGet:
-      path: /stac/healthz
-      port: http
-    periodSeconds: 2
-    failureThreshold: 30
-
-  livenessProbe:
-    httpGet:
-      path: /stac/healthz
-      port: http
-    periodSeconds: 60
-    failureThreshold: 3
-
-  readinessProbe:
-    httpGet:
-      path: /stac/healthz
-      port: http
-    periodSeconds: 5
-    failureThreshold: 3
-
 ######################
 # TESTING INFRASTRUCTURE
 ######################
diff --git a/charts/eoapi/values.yaml b/charts/eoapi/values.yaml
index c19386dd..402b6cec 100644
--- a/charts/eoapi/values.yaml
+++ b/charts/eoapi/values.yaml
@@ -485,7 +485,7 @@ stac:
 stac-auth-proxy:
   enabled: false
   image:
-    tag: "v1.1.0"
+    tag: "v1.2.0"
   ingress:
     enabled: false  # Handled by main eoapi ingress
   service:
@@ -516,6 +516,8 @@ stac-auth-proxy:
     # http://localhost:8081/... for an oauth2-proxy sidecar; set to your OIDC service when testing)
     # UPSTREAM_URL must be set to "http://<release-name>-stac:8080" (required)
     ROOT_PATH: "/stac"
+    # Skip ROOT_PATH rewrite for these prefixes in STAC response links
+    ROOT_PATH_SKIP_PREFIXES: "/raster,/vector,/browser,/multidim"
     OVERRIDE_HOST: "false"
     #
     # Authentication filters settings:
diff --git a/docs/stac-auth-proxy.md b/docs/stac-auth-proxy.md
index 80df38b5..3c505cd1 100644
--- a/docs/stac-auth-proxy.md
+++ b/docs/stac-auth-proxy.md
@@ -50,6 +50,7 @@ stac-auth-proxy:
     OIDC_DISCOVERY_INTERNAL_URL: "https://your-auth-provider.com/.well-known/openid-configuration"
     ALLOWED_JWT_AUDIENCES: "https://your-api-audience.com"  # Recommended: should match the audience configured in your identity provider for this API.
     ROOT_PATH: "/stac"
+    ROOT_PATH_SKIP_PREFIXES: "/raster,/vector,/browser,/multidim"
 ```
 
 For complete configuration options, see the [stac-auth-proxy configuration documentation](https://developmentseed.org/stac-auth-proxy/user-guide/configuration).
@@ -132,3 +133,9 @@ stac-auth-proxy manages the `/stac` prefix and forwards requests without it to t
 ```
 Client: /stac/collections → Proxy: /collections → STAC service receives: /collections
 ```
+
+### `ROOT_PATH_SKIP_PREFIXES`
+
+When rewriting `links` in STAC JSON responses (items, collections, search, …), the proxy adds `/stac` to same-host hrefs. That also catches links to other apps on the same host (`/raster/...` → `/stac/raster/...`). List those apps' path prefixes here so their hrefs stay untouched.
+
+This chart defaults to `/raster,/vector,/browser,/multidim`. Update if you change a service `ingress.path`. See [upstream docs](https://developmentseed.org/stac-auth-proxy/user-guide/configuration/#root_path_skip_prefixes).