diff --git a/.bazelci/basic-auth-tests.sh b/.bazelci/basic-auth-tests.sh
index 43f09027..6dd5dad7 100755
--- a/.bazelci/basic-auth-tests.sh
+++ b/.bazelci/basic-auth-tests.sh
@@ -144,6 +144,7 @@ bazel build //:bazel-remote --remote_cache=grpc://localhost:9092 \
 kill -9 $server_pid
 sleep 2
 ./bazel-remote --dir "$tmpdir/cache" --max_size 1 --http_address "0.0.0.0:$HTTP_PORT" \
+  --enable_endpoint_metrics \
 	--htpasswd_file "$tmpdir/htpasswd" > "$tmpdir/bazel-remote-authenticated.log" 2>&1 &
 server_pid=$!
 
@@ -186,6 +187,15 @@ then
 	exit 1
 fi
 
+# Unauthenticated status read should fail.
+if wget --inet4-only -d -O - --timeout=2 \
+	"http://localhost:$HTTP_PORT/status"
+then
+	echo "Error: expected unauthenticated read to fail"
+	kill -9 $server_pid
+	exit 1
+fi
+
 # Run without auth, expect no access.
 if ! bazel run //utils/grpcreadclient -- -server-addr localhost:9092
 then
diff --git a/main.go b/main.go
index 89581622..08c3017c 100644
--- a/main.go
+++ b/main.go
@@ -321,7 +321,7 @@ func startHttpServer(c *config.Config, httpServer **http.Server,
 		}
 		mux.Handle("/metrics", middlewareHandler)
 
-		statusHandler = middlewarestd.Handler("status", metricsMdlw, http.HandlerFunc(h.StatusPageHandler)).ServeHTTP
+		statusHandler = middlewarestd.Handler("status", metricsMdlw, statusHandler).ServeHTTP
 
 		ch := cacheHandler // Avoid an infinite loop in the closure below.
 		cacheHandler = func(w http.ResponseWriter, r *http.Request) {