diff --git a/roles/docker/templates/Caddyfile.j2 b/roles/docker/templates/Caddyfile.j2
index bc12601..fedc1c5 100644
--- a/roles/docker/templates/Caddyfile.j2
+++ b/roles/docker/templates/Caddyfile.j2
@@ -48,16 +48,14 @@ thesatelliteoflove.com {
     # WebFinger for phil@ serves two readers: the fediverse (GoToSocial's account
     # domain is this apex) and Tailscale, which finds the tailnet's login
     # provider through the OpenID issuer link.
-    @webfinger_phil {
-        path /.well-known/webfinger
-        query resource=acct:phil@{{ primary_domain }}
-    }
+    # Answered for every query: Tailscale's lookup doesn't always send
+    # resource=acct:phil@..., and phil is the only account here anyway.
+    @webfinger_phil path /.well-known/webfinger
     route {
         header @webfinger_phil Content-Type application/jrd+json
         header @webfinger_phil Access-Control-Allow-Origin *
         respond @webfinger_phil `{"subject":"acct:phil@{{ primary_domain }}","aliases":["https://{{ subdomains.social }}/users/phil","https://{{ subdomains.social }}/@phil"],"links":[{"rel":"http://openid.net/specs/connect/1.0/issuer","href":"https://{{ subdomains.pocketid }}"},{"rel":"http://webfinger.net/rel/profile-page","type":"text/html","href":"https://{{ subdomains.social }}/@phil"},{"rel":"self","type":"application/activity+json","href":"https://{{ subdomains.social }}/users/phil"}]}` 200
         # Other fediverse discovery goes to GoToSocial.
-        redir /.well-known/webfinger https://{{ subdomains.social }}{uri} 301
         redir /.well-known/host-meta* https://{{ subdomains.social }}{uri} 301
         redir /.well-known/nodeinfo https://{{ subdomains.social }}{uri} 301
     }