diff --git a/macropad-relay/public/app.html b/macropad-relay/public/app.html
index f6bf2d7..81bf676 100644
--- a/macropad-relay/public/app.html
+++ b/macropad-relay/public/app.html
@@ -427,7 +427,10 @@
                 }
 
                 container.innerHTML = entries.map(([id, macro]) => {
-                    const imageSrc = macro.image_path ? `/${this.sessionId}/api/image/${macro.image_path}` : null;
+                    // Include password as query param for image authentication
+                    const imageSrc = macro.image_path
+                        ? `/${this.sessionId}/api/image/${macro.image_path}?password=${encodeURIComponent(this.password)}`
+                        : null;
                     const firstChar = macro.name.charAt(0).toUpperCase();
                     return `
                         <div class="macro-card" data-macro-id="${id}" onclick="app.executeMacro('${id}')">