diff --git a/cmd/gate/app-healthy.go b/cmd/gate/app-healthy.go
index fd429482f..d5f3b24b4 100644
--- a/cmd/gate/app-healthy.go
+++ b/cmd/gate/app-healthy.go
@@ -17,12 +17,16 @@ const (
 )
 
 func attachHealthy(r *mux.Router, h Healthy) {
-	r.HandleFunc("/-/ready", func(w http.ResponseWriter, r *http.Request) {
+	healthy := r.PathPrefix(systemPath + "/-").
+		Subrouter().
+		StrictSlash(true)
+
+	healthy.HandleFunc("/ready", func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		_, _ = fmt.Fprintln(w, healthyState+"ready")
 	})
 
-	r.HandleFunc("/-/healthy", func(w http.ResponseWriter, r *http.Request) {
+	healthy.HandleFunc("/healthy", func(w http.ResponseWriter, r *http.Request) {
 		code := http.StatusOK
 		msg := "healthy"
 
diff --git a/cmd/gate/app-metrics.go b/cmd/gate/app-metrics.go
index c2e34f8d8..dea8d445f 100644
--- a/cmd/gate/app-metrics.go
+++ b/cmd/gate/app-metrics.go
@@ -7,11 +7,14 @@ import (
 	"go.uber.org/zap"
 )
 
-func attachMetrics(v *viper.Viper, l *zap.Logger, r *mux.Router) {
+func attachMetrics(r *mux.Router, v *viper.Viper, l *zap.Logger) {
 	if !v.GetBool(cfgEnableMetrics) {
 		return
 	}
 
 	l.Info("enable metrics")
-	r.Handle("/metrics", promhttp.Handler())
+	r.PathPrefix(systemPath+"/metrics").
+		Subrouter().
+		StrictSlash(true).
+		Handle("", promhttp.Handler())
 }
diff --git a/cmd/gate/app-profiler.go b/cmd/gate/app-profiler.go
index be5c2d043..58879f691 100644
--- a/cmd/gate/app-profiler.go
+++ b/cmd/gate/app-profiler.go
@@ -8,16 +8,25 @@ import (
 	"go.uber.org/zap"
 )
 
-func attachProfiler(v *viper.Viper, l *zap.Logger, r *mux.Router) {
+func attachProfiler(r *mux.Router, v *viper.Viper, l *zap.Logger) {
 	if !v.GetBool(cfgEnableProfiler) {
 		return
 	}
 
 	l.Info("enable profiler")
 
-	r.HandleFunc("/debug/pprof/", pprof.Index)
-	r.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
-	r.HandleFunc("/debug/pprof/profile", pprof.Profile)
-	r.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
-	r.HandleFunc("/debug/pprof/trace", pprof.Trace)
+	profiler := r.PathPrefix(systemPath + "/debug/pprof").
+		Subrouter().
+		StrictSlash(true)
+
+	profiler.HandleFunc("/", pprof.Index)
+	profiler.HandleFunc("/cmdline", pprof.Cmdline)
+	profiler.HandleFunc("/profile", pprof.Profile)
+	profiler.HandleFunc("/symbol", pprof.Symbol)
+	profiler.HandleFunc("/trace", pprof.Trace)
+
+	// Manually add support for paths linked to by index page at /debug/pprof/
+	for _, item := range []string{"allocs", "block", "heap", "goroutine", "mutex", "threadcreate"} {
+		profiler.Handle("/"+item, pprof.Handler(item))
+	}
 }
diff --git a/cmd/gate/app.go b/cmd/gate/app.go
index c75af621a..8ec71ee13 100644
--- a/cmd/gate/app.go
+++ b/cmd/gate/app.go
@@ -6,7 +6,6 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/gorilla/mux"
 	minio "github.com/minio/minio/legacy"
 	"github.com/minio/minio/neofs/layer"
 	"github.com/minio/minio/neofs/pool"
@@ -22,7 +21,6 @@ type (
 	App struct {
 		cli pool.Pool
 		log *zap.Logger
-		web *mux.Router
 		cfg *viper.Viper
 		obj minio.ObjectLayer
 
@@ -108,19 +106,21 @@ func newApp(l *zap.Logger, v *viper.Viper) *App {
 				zap.Error(err))
 		}
 
+		l.Info("credentials",
+			zap.String("AccessKey", uid.String()),
+			zap.String("SecretKey", wif))
+
 		if obj, err = layer.NewLayer(cli, auth.Credentials{AccessKey: uid.String(), SecretKey: wif}); err != nil {
 			l.Fatal("could not prepare ObjectLayer",
 				zap.Error(err))
 		}
-
-		_ = obj
 	}
 
 	return &App{
 		cli: cli,
 		log: l,
 		cfg: v,
-		web: minio.NewRouter(obj),
+		obj: obj,
 
 		webDone: make(chan struct{}, 1),
 		wrkDone: make(chan struct{}, 1),
@@ -150,7 +150,7 @@ func (a *App) Server(ctx context.Context) {
 		err  error
 		lis  net.Listener
 		lic  net.ListenConfig
-		srv  = http.Server{Handler: a.web}
+		srv  = new(http.Server)
 		addr = a.cfg.GetString(cfgListenAddress)
 	)
 
@@ -159,10 +159,18 @@ func (a *App) Server(ctx context.Context) {
 			zap.Error(err))
 	}
 
+	router := newS3Router()
+
 	// Attach app-specific routes:
-	attachHealthy(a.web, a.cli)
-	attachMetrics(a.cfg, a.log, a.web)
-	attachProfiler(a.cfg, a.log, a.web)
+	attachHealthy(router, a.cli)
+	attachMetrics(router, a.cfg, a.log)
+	attachProfiler(router, a.cfg, a.log)
+
+	// Attach S3 API:
+	minio.AttachS3API(router, a.obj)
+
+	// Use mux.Router as http.Handler
+	srv.Handler = router
 
 	go func() {
 		a.log.Info("starting server",
diff --git a/cmd/gate/app_router.go b/cmd/gate/app_router.go
new file mode 100644
index 000000000..0f8efc0af
--- /dev/null
+++ b/cmd/gate/app_router.go
@@ -0,0 +1,12 @@
+package main
+
+import "github.com/gorilla/mux"
+
+const systemPath = "/system"
+
+func newS3Router() *mux.Router {
+	// Initialize router. `SkipClean(true)` stops gorilla/mux from
+	// normalizing URL path minio/minio#3256
+	// avoid URL path encoding minio/minio#8950
+	return mux.NewRouter().SkipClean(true).UseEncodedPath()
+}
diff --git a/legacy/neofs-router.go b/legacy/neofs-router.go
index b2c16cf5f..5ce9c2a9d 100644
--- a/legacy/neofs-router.go
+++ b/legacy/neofs-router.go
@@ -4,20 +4,15 @@ import (
 	"github.com/gorilla/mux"
 )
 
-func NewRouter(obj ObjectLayer) *mux.Router {
-	// Initialize router. `SkipClean(true)` stops gorilla/mux from
-	// normalizing URL path minio/minio#3256
-	// avoid URL path encoding minio/minio#8950
-	router := mux.NewRouter().SkipClean(true).UseEncodedPath()
-
+func AttachS3API(r *mux.Router, obj ObjectLayer) {
 	// Add healthcheck router
-	registerHealthCheckRouter(router)
+	registerHealthCheckRouter(r)
 
 	// Add server metrics router
-	registerMetricsRouter(router)
+	registerMetricsRouter(r)
 
 	// Add API router.
-	registerAPIRouter(router, true, true)
+	registerAPIRouter(r, true, true)
 
 	layer := NewGatewayLayerWithLocker(obj)
 
@@ -39,6 +34,4 @@ func NewRouter(obj ObjectLayer) *mux.Router {
 	globalObjLayerMutex.Lock()
 	globalSafeMode = false
 	globalObjLayerMutex.Unlock()
-
-	return router
 }