diff --git a/src/lib/services/interests.service.ts b/src/lib/services/interests.service.ts
index 16347dac..c2210280 100644
--- a/src/lib/services/interests.service.ts
+++ b/src/lib/services/interests.service.ts
@@ -1,4 +1,4 @@
-import { and, desc, eq, exists, inArray, isNull, ne, sql } from 'drizzle-orm';
+import { and, desc, eq, exists, gte, inArray, isNull, ne, sql } from 'drizzle-orm';
 
 import { db } from '@/lib/db';
 import { interests, interestBerths, interestTags, interestNotes } from '@/lib/db/schema/interests';
@@ -561,10 +561,7 @@ export async function getInterestById(id: string, portId: string) {
     .select({ count: sql<number>`count(*)::int` })
     .from(interestContactLog)
     .where(
-      and(
-        eq(interestContactLog.interestId, id),
-        sql`${interestContactLog.occurredAt} >= ${sevenDaysAgo}`,
-      ),
+      and(eq(interestContactLog.interestId, id), gte(interestContactLog.occurredAt, sevenDaysAgo)),
     );
 
   // Resolve the assignee's display name for the header chip — falling back
diff --git a/src/proxy.ts b/src/proxy.ts
index c36fa951..26efc21f 100644
--- a/src/proxy.ts
+++ b/src/proxy.ts
@@ -57,6 +57,10 @@ const PUBLIC_PATHS: string[] = [
   '/api/public/',
   '/api/health',
   '/api/webhooks/',
+  // First-run / cold-start: the unauthenticated /setup and /login pages
+  // call /api/v1/bootstrap/status to decide whether to render the setup
+  // form. The route handlers self-protect via hasAnySuperAdmin().
+  '/api/v1/bootstrap/',
   '/scan',
   '/portal/',
   '/api/portal/',