diff --git a/castle-api/src/castle_api/routes.py b/castle-api/src/castle_api/routes.py
index 010b523..d027c5b 100644
--- a/castle-api/src/castle_api/routes.py
+++ b/castle-api/src/castle_api/routes.py
@@ -878,6 +878,8 @@ def get_gateway() -> GatewayInfo:
         )
         for r in compute_routes(registry, config, remote or None)
     ]
+    # Caddyfile order is precedence-sensitive; the displayed table is alphabetical.
+    routes.sort(key=lambda r: r.address)
 
     return GatewayInfo(
         port=registry.node.gateway_port,
diff --git a/cli/src/castle_cli/commands/gateway.py b/cli/src/castle_cli/commands/gateway.py
index 06ae0e0..c950ea0 100644
--- a/cli/src/castle_cli/commands/gateway.py
+++ b/cli/src/castle_cli/commands/gateway.py
@@ -137,9 +137,10 @@ def _gateway_status() -> int:
         return 0
 
     # Each route: address → target, tagged by kind. static = files served in
-    # place; proxy/remote = reverse-proxied to a process.
+    # place; proxy/remote = reverse-proxied to a process. (Caddyfile order is
+    # precedence-sensitive; this table is alphabetical.)
     print(f"\n  {'ADDRESS':24} {'KIND':7} TARGET")
-    for r in routes:
+    for r in sorted(routes, key=lambda r: r.address):
         target = r.target.replace("localhost:", ":") if r.kind != "static" else r.target
         print(f"  {r.address:24} {r.kind:7} {target}")
     return 0