diff --git a/internal/remote/firecrest/controller.go b/internal/remote/firecrest/controller.go
index ffd93c73..87c2a309 100644
--- a/internal/remote/firecrest/controller.go
+++ b/internal/remote/firecrest/controller.go
@@ -449,8 +449,8 @@ func (c *FirecrestRemoteSessionController) Start(ctx context.Context) error {
 			return err
 		}
 		env["WSTUNNEL_SERVICE_ADDRESS"] = renkuBaseURL.Hostname()
-		env["WSTUNNEL_SERVICE_PORT"] = fmt.Sprintf("%d", 443)                                   // wss port (same as https)
-		env["WSTUNNEL_PATH_PREFIX"] = renkuBaseURLPath + "/" + v1alpha1.TunnelIngressPathSuffix // session path with tunnel
+		env["WSTUNNEL_SERVICE_PORT"] = fmt.Sprintf("%d", 443)              // wss port (same as https)
+		env["WSTUNNEL_PATH_PREFIX"] = wstunnelPathPrefix(renkuBaseURLPath) // session path with tunnel
 	}
 	// Setup environment variables for git repositories
 	repos := []string{}
@@ -1055,3 +1055,9 @@ func getPreferredScratch(fileSystems *[]FileSystem) *FileSystem {
 	}
 	return scratch
 }
+
+// wstunnelPathPrefix returns the -P value for the remote wstunnel client. wstunnel prepends a "/" to
+// it when building the upgrade request, so the prefix must not carry one itself.
+func wstunnelPathPrefix(renkuBaseURLPath string) string {
+	return strings.TrimPrefix(path.Join(renkuBaseURLPath, v1alpha1.TunnelIngressPathSuffix), "/")
+}
diff --git a/internal/remote/firecrest/controller_test.go b/internal/remote/firecrest/controller_test.go
index 2ac1b9b6..9d991513 100644
--- a/internal/remote/firecrest/controller_test.go
+++ b/internal/remote/firecrest/controller_test.go
@@ -148,3 +148,23 @@ func TestStreamsToFetch(t *testing.T) {
 		})
 	}
 }
+
+func TestWstunnelPathPrefix(t *testing.T) {
+	tests := []struct {
+		name             string
+		renkuBaseURLPath string
+		want             string
+	}{
+		{"leading slash", "/sessions/my-session", "sessions/my-session/__amalthea__/tunnel"},
+		{"no leading slash", "sessions/my-session", "sessions/my-session/__amalthea__/tunnel"},
+		{"trailing slash", "/sessions/my-session/", "sessions/my-session/__amalthea__/tunnel"},
+		{"doubled leading slash", "//sessions/my-session", "sessions/my-session/__amalthea__/tunnel"},
+	}
+	// wstunnel's client prepends a "/" when it builds the upgrade request, so a prefix with a leading
+	// slash produces a "//sessions/..." request path that strict path-matching proxies do not route.
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, wstunnelPathPrefix(tt.renkuBaseURLPath))
+		})
+	}
+}