diff --git a/project/apps/pos/src/proxy.ts b/project/apps/pos/src/proxy.ts
index 61de4b9..974f404 100644
--- a/project/apps/pos/src/proxy.ts
+++ b/project/apps/pos/src/proxy.ts
@@ -1,13 +1,20 @@
 import { NextResponse } from 'next/server';
 import type { NextRequest } from 'next/server';
 
-const PUBLIC_PATHS = ['/login', '/api/auth', '/api/backoffice/auth'];
+const PUBLIC_PATHS = [
+  '/login',
+  '/api/auth',
+  '/api/backoffice/auth',
+  '/manifest.json',
+  '/manifest.webmanifest',
+  '/favicon.ico',
+];
 
 export function proxy(request: NextRequest) {
   const { pathname } = request.nextUrl;
 
-  // Allow public paths
-  if (PUBLIC_PATHS.some((p) => pathname.startsWith(p))) {
+  // Allow public paths (including PWA manifest, which Authelia was intercepting)
+  if (PUBLIC_PATHS.some((p) => pathname === p || pathname.startsWith(p + '/'))) {
     return NextResponse.next();
   }
 
diff --git a/project/src/modules/pos/api/pos.routes.ts b/project/src/modules/pos/api/pos.routes.ts
index ff2d058..220b200 100644
--- a/project/src/modules/pos/api/pos.routes.ts
+++ b/project/src/modules/pos/api/pos.routes.ts
@@ -1704,10 +1704,10 @@ export async function registerPosRoutes(app: FastifyInstance, deps: PosRouteDeps
         querystring: {
           type: 'object',
           properties: {
-            sessionId: { type: 'string', format: 'uuid' },
-            terminalId: { type: 'string', format: 'uuid' },
+            sessionId: { type: 'string' },
+            terminalId: { type: 'string' },
             state: { type: 'string', enum: ['PENDING', 'COMPLETED'] },
-            storeId: { type: 'string', format: 'uuid' },
+            storeId: { type: 'string' },
             limit: { type: 'integer', minimum: 1, maximum: 100, default: 20 },
           },
         },