diff --git a/docs/lab/prod/on-router/README.md b/docs/lab/prod/on-router/README.md
index bce6c9f..5bd12bf 100644
--- a/docs/lab/prod/on-router/README.md
+++ b/docs/lab/prod/on-router/README.md
@@ -70,15 +70,20 @@ API and POSTs through the proxy, and events arriving within 50 ms):
             Require valid-user
         </Location>
 
-        # Apache's own error pages live under /error/ on servers with the
-        # multi-language error documents enabled. They must be served by
-        # Apache, not proxied, and must not themselves demand the password.
-        # Otherwise the 401 becomes ferrix's empty 404: a blank page and no
-        # password prompt in any browser without saved credentials.
-        <Location "/error/">
-            Require all granted
-        </Location>
-        ProxyPass        "/error/" "!"
+        # Use Apache's built-in error messages in this vhost. Servers with the
+        # multi-language error documents enabled fetch them from /error/,
+        # which this vhost would proxy to ferrix; a 401 then comes back as
+        # ferrix's empty 404: a blank page and no password prompt. With the
+        # built-in ones nothing is fetched, so nothing needs exempting from
+        # the login.
+        ErrorDocument 400 default
+        ErrorDocument 401 default
+        ErrorDocument 403 default
+        ErrorDocument 404 default
+        ErrorDocument 500 default
+        ErrorDocument 502 default
+        ErrorDocument 503 default
+        ErrorDocument 504 default
 
         ProxyPreserveHost On
         ProxyPass        "/" "http://127.0.0.1:8080/"