diff --git a/CHANGELOG.md b/CHANGELOG.md
index 994530b..b30b27c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.3] - 2026-01-03
+
+### Fixed
+- Fixed auth endpoint path: `/auth/me` → `/auth/users/me`
+
 ## [1.0.2] - 2026-01-03
 
 ### Fixed
diff --git a/lib/core/auth/auth_datasource.dart b/lib/core/auth/auth_datasource.dart
index 2129daa..c71e46b 100644
--- a/lib/core/auth/auth_datasource.dart
+++ b/lib/core/auth/auth_datasource.dart
@@ -102,7 +102,7 @@ class AuthDatasource {
   /// Returns user profile if authenticated via the proxy.
   /// Throws 401 if not authenticated or accessing directly.
   Future<AuthSyncResponse> getCurrentUser() async {
-    final response = await _dio.get<Map<String, dynamic>>('/auth/me');
+    final response = await _dio.get<Map<String, dynamic>>('/auth/users/me');
     return AuthSyncResponse.fromJson(response.data!);
   }
 
diff --git a/lib/core/auth/auth_provider.dart b/lib/core/auth/auth_provider.dart
index 9ac66bf..66a5a68 100644
--- a/lib/core/auth/auth_provider.dart
+++ b/lib/core/auth/auth_provider.dart
@@ -21,7 +21,7 @@ part 'auth_provider.g.dart';
 /// - **Web**: NPM forward auth with Authentik (cookies handled by proxy)
 /// - **Mobile**: OIDC Authorization Code flow with flutter_appauth
 ///
-/// On web, the app calls GET /auth/me to check if user is authenticated
+/// On web, the app calls GET /auth/users/me to check if user is authenticated
 /// via NPM forward auth headers. On mobile, uses OIDC flow then POST /auth/sync.
 @riverpod
 class AuthNotifier extends _$AuthNotifier {
@@ -59,7 +59,7 @@ class AuthNotifier extends _$AuthNotifier {
   /// Returns AuthState if authenticated, null if not.
   Future<AuthState?> _tryWebAuth() async {
     try {
-      developer.log('Attempting web auth via /auth/me', name: 'auth');
+      developer.log('Attempting web auth via /auth/users/me', name: 'auth');
       final authDatasource = ref.read(authDatasourceProvider);
       final syncResponse = await authDatasource.getCurrentUser();
 
@@ -238,7 +238,7 @@ class AuthNotifier extends _$AuthNotifier {
     // User needs to access via the authenticated proxy URL
     if (kIsWeb) {
       developer.log('Web sign-in: user should access via authenticated proxy', name: 'auth');
-      // Try to refresh auth state from /auth/me
+      // Try to refresh auth state from /auth/users/me
       state = const AsyncLoading();
       final webAuth = await _tryWebAuth();
       if (webAuth != null) {
diff --git a/pubspec.yaml b/pubspec.yaml
index b497a75..d04896b 100644
--- a/pubspec.yaml
+++ b/pubspec.yaml
@@ -16,7 +16,7 @@ publish_to: 'none' # Remove this line if you wish to publish to pub.dev
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
 # In Windows, build-name is used as the major, minor, and patch parts
 # of the product and file versions while build-number is used as the build suffix.
-version: 1.0.2+1
+version: 1.0.3+1
 
 environment:
   sdk: ^3.10.4