diff --git a/src/lib/api/feed/custom.ts b/src/lib/api/feed/custom.ts
index 5ff27f7..497d700 100644
--- a/src/lib/api/feed/custom.ts
+++ b/src/lib/api/feed/custom.ts
@@ -52,16 +52,30 @@ export class CustomFeedAPI implements FeedAPI {
     cursor: string | undefined
     limit: number
   }): Promise<FeedAPIResponse> {
-    // Microcosm batch path: Slingshot proxies the feed generator's PUBLIC
-    // skeleton and fetches all post records in one request. Slingshot's batch
-    // proxy rejects a forwarded auth token (returns 400), so we only use this
-    // path logged out. Logged-in users go through the AppView below, which
-    // forwards the viewer's auth correctly (needed for personalized feeds).
-    if (MICROCOSM_ENABLED && !this.agent.did) {
+    // Microcosm batch path: Slingshot proxies the feed generator's skeleton and
+    // fetches all post records in one request. For personalized feeds we forward
+    // a service-auth token (aud = the feed generator's DID) so the generator can
+    // identify the viewer, exactly as the AppView would.
+    if (MICROCOSM_ENABLED) {
       try {
         const page = await buildCustomFeed(this.params.feed, {
+          viewerDid: this.agent.did,
           limit,
           cursor,
+          getAuthorization: this.agent.did
+            ? async (feedGenDid: string) => {
+                try {
+                  const {data} =
+                    await this.agent.com.atproto.server.getServiceAuth({
+                      aud: feedGenDid,
+                      lxm: 'app.bsky.feed.getFeedSkeleton',
+                    })
+                  return data.token
+                } catch {
+                  return undefined
+                }
+              }
+            : undefined,
         })
         if (page.feed.length) {
           return {cursor: page.cursor, feed: page.feed}