diff --git a/scripts/cli/commands/updater/cli_updater_ladder.sh b/scripts/cli/commands/updater/cli_updater_ladder.sh
index 1c71780..1227bd5 100644
--- a/scripts/cli/commands/updater/cli_updater_ladder.sh
+++ b/scripts/cli/commands/updater/cli_updater_ladder.sh
@@ -36,6 +36,7 @@ updaterTagSortKey() {
 # ladder is built by PROBING each candidate, never by enumerating.
 updaterTagExists() {
     local repo="${1%%:*}" tag="$2"
+    repo="${repo#docker.io/}"; repo="${repo#index.docker.io/}"   # docker.io/ IS Hub
     case "$repo" in *.*/*|localhost/*) return 1 ;; esac        # non-Hub: unknown
     case "$repo" in */*) : ;; *) repo="library/$repo" ;; esac
     command -v curl >/dev/null 2>&1 || return 1
diff --git a/scripts/webui/data/generators/updater/webui_updater_scan.sh b/scripts/webui/data/generators/updater/webui_updater_scan.sh
index 24c1054..04e424f 100644
--- a/scripts/webui/data/generators/updater/webui_updater_scan.sh
+++ b/scripts/webui/data/generators/updater/webui_updater_scan.sh
@@ -122,6 +122,11 @@ updaterRegistryDigest() {
 # they are returned newest-first and we only care about ones ABOVE the current.
 updaterRegistryTags() {
     local repo="${1%%:*}"                       # strip any :tag
+    # docker.io/ IS Docker Hub, just spelled out — several apps write it that
+    # way (docker.io/authelia/authelia). Stripping the prefix before the
+    # host check stops those being mistaken for a third-party registry and
+    # silently skipped.
+    repo="${repo#docker.io/}"; repo="${repo#index.docker.io/}"
     case "$repo" in
         *.*/*|localhost/*) return 0 ;;          # a real registry host — not Hub
     esac