Custom-hostname DCV requests arrive over plain HTTP, and when the customer's domain is itself proxied through Cloudflare they reach the Worker instead of being answered at the edge. Two failures stacked there. The server hook built an OAuth client from the request origin on every request, and an http:// origin fails client-metadata validation — a 500 for all plain-HTTP traffic; tenant requests now skip the client entirely (every consumer of locals.oauth is an app-only path) and the hosted client mints its https identity regardless of request scheme. And nothing served the challenge: the hook now answers /.well-known/acme-challenge/ on custom-domain hosts from the custom-hostname API's validation records, fetching the per-hostname detail because the list endpoint can omit them. The certificate for mooring.malpercio.dev issued within minutes of the challenge answering going live. Renewals reuse the same path. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>