diff --git a/config-service/src/main/resources/configurations/gateway-service.yml b/config-service/src/main/resources/configurations/gateway-service.yml
index aed44fd..e53121c 100644
--- a/config-service/src/main/resources/configurations/gateway-service.yml
+++ b/config-service/src/main/resources/configurations/gateway-service.yml
@@ -221,7 +221,10 @@ spring:
         - id: product-service
           uri: lb://PRODUCT-SERVICE
           predicates:
-            - Path=/api/v1/products/**
+            # Fase 4: /categories is a new top-level resource also served by product-service
+            # (category admin CRUD). Same route/filters as products; write auth is enforced
+            # inside product-service (@PreAuthorize ADMIN), mirroring how products works.
+            - Path=/api/v1/products/**,/api/v1/categories/**
           filters:
             - AddResponseHeader=API-Version, v1
             - AddResponseHeader=Sunset, TBD
@@ -398,6 +401,9 @@ gateway:
   public-paths:
     - /api/v1/auth/**
     - /api/v1/products/**
+    # Fase 4: like products, the gateway lets categories through unauthenticated and
+    # product-service enforces write auth (GET public; POST/PUT/DELETE → ADMIN).
+    - /api/v1/categories/**
     - /actuator/**
     - /fallback/**
   load-shedding:
diff --git a/docker-compose.yml b/docker-compose.yml
index 1aa267a..6bec3a3 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -451,7 +451,7 @@ services:
       JWT_SECRET: ${JWT_SECRET:-bXlTdXBlclNlY3VyZVNlY3JldEtleUZvckpXVEF1dGgxMjM0NTY3ODk=}
       GATEWAY_MAX_CONCURRENT: 5000
       GATEWAY_TENANT_SERVICE_BASE_URL: http://tenant-service:8095
-      GATEWAY_PUBLIC_PATHS: /api/v1/auth/**,/actuator/**,/fallback/**,/api/v1/products,/api/v1/products/**
+      GATEWAY_PUBLIC_PATHS: /api/v1/auth/**,/actuator/**,/fallback/**,/api/v1/products,/api/v1/products/**,/api/v1/categories,/api/v1/categories/**
       VAULT_ENABLED: ${VAULT_ENABLED:-false}
       VAULT_HOST: ${VAULT_HOST:-vault}
       VAULT_TOKEN: ${VAULT_TOKEN:-root-token}