diff --git a/roles/docker/templates/Caddyfile.j2 b/roles/docker/templates/Caddyfile.j2
index 8a2d220..bc12601 100644
--- a/roles/docker/templates/Caddyfile.j2
+++ b/roles/docker/templates/Caddyfile.j2
@@ -45,6 +45,22 @@ git.thesatelliteoflove.com {
 }
 
 thesatelliteoflove.com {
+    # WebFinger for phil@ serves two readers: the fediverse (GoToSocial's account
+    # domain is this apex) and Tailscale, which finds the tailnet's login
+    # provider through the OpenID issuer link.
+    @webfinger_phil {
+        path /.well-known/webfinger
+        query resource=acct:phil@{{ primary_domain }}
+    }
+    route {
+        header @webfinger_phil Content-Type application/jrd+json
+        header @webfinger_phil Access-Control-Allow-Origin *
+        respond @webfinger_phil `{"subject":"acct:phil@{{ primary_domain }}","aliases":["https://{{ subdomains.social }}/users/phil","https://{{ subdomains.social }}/@phil"],"links":[{"rel":"http://openid.net/specs/connect/1.0/issuer","href":"https://{{ subdomains.pocketid }}"},{"rel":"http://webfinger.net/rel/profile-page","type":"text/html","href":"https://{{ subdomains.social }}/@phil"},{"rel":"self","type":"application/activity+json","href":"https://{{ subdomains.social }}/users/phil"}]}` 200
+        # Other fediverse discovery goes to GoToSocial.
+        redir /.well-known/webfinger https://{{ subdomains.social }}{uri} 301
+        redir /.well-known/host-meta* https://{{ subdomains.social }}{uri} 301
+        redir /.well-known/nodeinfo https://{{ subdomains.social }}{uri} 301
+    }
     root * /srv/tsol
     file_server
 }