diff --git a/x-ui-latest.sh b/x-ui-latest.sh
index 7583779..e8c11c7 100644
--- a/x-ui-latest.sh
+++ b/x-ui-latest.sh
@@ -505,9 +505,14 @@ server {
     # skip it (rewrite phase), hence the try_files → named-location hop.
     location = /${panel_path}/diag {
         auth_request /__diag_auth;
-        error_page 401 403 =302 /${panel_path}/;
+        # Named location (not "=302 /uri") so the deny path emits a real Location
+        # header; an internal-redirect error_page returns a 302 with no Location.
+        error_page 401 403 = @diag_login;
         try_files /__nonexistent @diag_sso_ok;
     }
+    location @diag_login {
+        return 302 /${panel_path}/;
+    }
     location @diag_sso_ok {
         add_header Set-Cookie "diag_key=${diag_token}; Path=${diag_path}; Secure; HttpOnly; SameSite=Lax; Max-Age=604800";
         return 302 ${diag_path};
diff --git a/x-ui-patch.sh b/x-ui-patch.sh
index c2a0f3b..bf7d72e 100644
--- a/x-ui-patch.sh
+++ b/x-ui-patch.sh
@@ -373,9 +373,14 @@ server {
     # hence the try_files → named-location hop.
     location = /${panel_path}/diag {
         auth_request /__diag_auth;
-        error_page 401 403 =302 /${panel_path}/;
+        # Named location (not "=302 /uri") so the deny path emits a real Location
+        # header; an internal-redirect error_page returns a 302 with no Location.
+        error_page 401 403 = @diag_login;
         try_files /__nonexistent @diag_sso_ok;
     }
+    location @diag_login {
+        return 302 /${panel_path}/;
+    }
     location @diag_sso_ok {
         add_header Set-Cookie "diag_key=${diag_token}; Path=${diag_path}; Secure; HttpOnly; SameSite=Lax; Max-Age=604800";
         return 302 ${diag_path};