diff --git a/crates/tranquil-api/src/identity/did.rs b/crates/tranquil-api/src/identity/did.rs
index ccc0609..98f541a 100644
--- a/crates/tranquil-api/src/identity/did.rs
+++ b/crates/tranquil-api/src/identity/did.rs
@@ -747,8 +747,10 @@ pub async fn well_known_atproto_did(State(state): State<AppState>, headers: Head
     };
     let user = state.repos.user.get_by_handle(&handle).await;
     match user {
-        Ok(Some(row)) => row.did.to_string().into_response(),
-        Ok(None) => (StatusCode::NOT_FOUND, "Handle not found").into_response(),
+        Ok(Some(row)) if row.takedown_ref.is_none() && row.deactivated_at.is_none() => {
+            row.did.to_string().into_response()
+        }
+        Ok(Some(_)) | Ok(None) => (StatusCode::NOT_FOUND, "Handle not found").into_response(),
         Err(e) => {
             error!("DB error in well-known atproto-did: {:?}", e);
             (StatusCode::INTERNAL_SERVER_ERROR, "Internal error").into_response()
diff --git a/crates/tranquil-pds/tests/admin_moderation.rs b/crates/tranquil-pds/tests/admin_moderation.rs
index 2adefa2..86786a0 100644
--- a/crates/tranquil-pds/tests/admin_moderation.rs
+++ b/crates/tranquil-pds/tests/admin_moderation.rs
@@ -146,6 +146,13 @@ async fn test_update_subject_status_takedown_user_without_ref_updates_sync_statu
         .await
         .unwrap();
     assert_eq!(resolve_before.status(), StatusCode::OK);
+    let well_known_before = client
+        .get(format!("{}/.well-known/atproto-did", base_url().await))
+        .header(reqwest::header::HOST, target_handle.as_str())
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(well_known_before.status(), StatusCode::OK);
     let payload = json!({
         "subject": {
             "$type": "com.atproto.admin.defs#repoRef",
@@ -180,6 +187,14 @@ async fn test_update_subject_status_takedown_user_without_ref_updates_sync_statu
     let resolve_body: Value = resolve_after.json().await.unwrap();
     assert_eq!(resolve_body["error"], "InvalidRequest");
 
+    let well_known_after = client
+        .get(format!("{}/.well-known/atproto-did", base_url().await))
+        .header(reqwest::header::HOST, target_handle.as_str())
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(well_known_after.status(), StatusCode::NOT_FOUND);
+
     let get_record_res = client
         .get(format!(
             "{}/xrpc/com.atproto.repo.getRecord",