diff --git a/internal/router/router.go b/internal/router/router.go
index af747730..07e1e57c 100644
--- a/internal/router/router.go
+++ b/internal/router/router.go
@@ -409,9 +409,13 @@ func RegisterRoutes(cfg *Config) *handlers.Handler {
 	admin := protected.Group("", handlers.AdminMiddleware)
 	registerScannerRoutes(protected, admin, scannerHandler)
 
-	// Hash conflict routes (admin only)
-	admin.GET("/api/admin/hash-conflicts", cfg.HashConflictsHandler.ListHashConflicts)
-	admin.POST("/api/admin/hash-conflicts/:id/resolve", cfg.HashConflictsHandler.ResolveHashConflict)
+	// Hash conflict routes (admin only). NOTE: `admin` already sits under the
+	// /api group (protected), so these paths must NOT start with /api —
+	// they used to, producing /api/api/admin/hash-conflicts while the admin
+	// page's htmx buttons posted to /api/admin/hash-conflicts/:id/resolve,
+	// which 404'd silently (htmx swaps nothing on error responses).
+	admin.GET("/admin/hash-conflicts", cfg.HashConflictsHandler.ListHashConflicts)
+	admin.POST("/admin/hash-conflicts/:id/resolve", cfg.HashConflictsHandler.ResolveHashConflict)
 
 	return scannerHandler
 }