diff --git a/src/lib/oauth.ts b/src/lib/oauth.ts
index c8e729c..72d3eb3 100644
--- a/src/lib/oauth.ts
+++ b/src/lib/oauth.ts
@@ -4,7 +4,10 @@
 import { BrowserOAuthClient } from '@atproto/oauth-client-browser';
 import { OAUTH_SCOPE } from './oauth-scope';
 
-const HANDLE_RESOLVER = 'https://bsky.social';
+// The public AppView, not the bsky.social entryway: the entryway caches handle -> DID for months
+// after a handle moves to another account (seen 2026-09-25: anders.sorby.xyz still resolved to its
+// previous account there), and the OAuth client's bi-directional check then rejects the sign-in.
+const HANDLE_RESOLVER = 'https://public.api.bsky.app';
 
 export async function createOAuthClient(): Promise<BrowserOAuthClient> {
   const origin = window.location.origin;