diff --git a/middleware.ts b/middleware.ts
index 35e24fc..7b78182 100644
--- a/middleware.ts
+++ b/middleware.ts
@@ -5,9 +5,13 @@ import { NextResponse } from "next/server";
 const { auth } = NextAuth(authConfig);
 
 export default auth((req) => {
-  const isLoggedIn = !!req.auth;
   const pathname = req.nextUrl.pathname;
 
+  // Allow all static files (svg, png, jpg, pdf, mp4, woff2, etc.)
+  if (pathname.includes(".")) return;
+
+  const isLoggedIn = !!req.auth;
+
   // Always allow auth API routes
   if (pathname.startsWith("/api/auth")) return;
 
@@ -31,8 +35,14 @@ export default auth((req) => {
     return NextResponse.redirect(new URL("/dashboard", req.url));
   }
 
-  // Force password change: redirect to /settings until they set a new password
-  if (isLoggedIn && req.auth?.user?.mustChangePassword && pathname !== "/settings" && !pathname.startsWith("/api/") && !pathname.startsWith("/_next/")) {
+  // Force password change
+  if (
+    isLoggedIn &&
+    req.auth?.user?.mustChangePassword &&
+    pathname !== "/settings" &&
+    !pathname.startsWith("/api/") &&
+    !pathname.startsWith("/_next/")
+  ) {
     return NextResponse.redirect(new URL("/settings", req.url));
   }
 
@@ -46,6 +56,7 @@ export default auth((req) => {
 
 export const config = {
   matcher: [
-    "/((?!_next/static|_next/image|favicon.ico|public|placeholder).*)",
+    // Skip Next.js internals and any file with an extension
+    "/((?!_next/static|_next/image|favicon.ico|.*\\..*).*)",
   ],
 };