diff --git a/pkg/channels/pico/pico.go b/pkg/channels/pico/pico.go
index e22da1ba1..c346ac094 100644
--- a/pkg/channels/pico/pico.go
+++ b/pkg/channels/pico/pico.go
@@ -349,7 +349,7 @@ func (c *PicoChannel) handleWebSocket(w http.ResponseWriter, r *http.Request) {
 	// Echo the matched subprotocol back so the browser accepts the upgrade.
 	var responseHeader http.Header
 	if proto := c.matchedSubprotocol(r); proto != "" {
-		responseHeader = http.Header{"Sec-WebSocket-Protocol": {proto}}
+		responseHeader = http.Header{"Sec-Websocket-Protocol": {proto}}
 	}
 
 	conn, err := c.upgrader.Upgrade(w, r, responseHeader)
@@ -387,7 +387,7 @@ func (c *PicoChannel) handleWebSocket(w http.ResponseWriter, r *http.Request) {
 
 // authenticate checks the request for a valid token:
 //  1. Authorization: Bearer <token> header
-//  2. Sec-WebSocket-Protocol "token.<value>" (for browsers that can't set headers)
+//  2. Sec-Websocket-Protocol "token.<value>" (for browsers that can't set headers)
 //  3. Query parameter "token" (only when AllowTokenQuery is on)
 func (c *PicoChannel) authenticate(r *http.Request) bool {
 	token := c.config.Token.String()
@@ -403,7 +403,7 @@ func (c *PicoChannel) authenticate(r *http.Request) bool {
 		}
 	}
 
-	// Check Sec-WebSocket-Protocol subprotocol ("token.<value>")
+	// Check Sec-Websocket-Protocol subprotocol ("token.<value>")
 	if c.matchedSubprotocol(r) != "" {
 		return true
 	}
diff --git a/web/backend/middleware/launcher_dashboard_auth.go b/web/backend/middleware/launcher_dashboard_auth.go
index 7e92fca22..f1c90f8da 100644
--- a/web/backend/middleware/launcher_dashboard_auth.go
+++ b/web/backend/middleware/launcher_dashboard_auth.go
@@ -166,6 +166,9 @@ func isPublicLauncherDashboardPath(method, p string) bool {
 	if isPublicLauncherDashboardStatic(method, p) {
 		return true
 	}
+	if p == "/pico/ws" && method == http.MethodGet {
+		return true
+	}
 	switch p {
 	case "/api/auth/login":
 		return method == http.MethodPost