diff --git a/src/gateway/public-gateway.mjs b/src/gateway/public-gateway.mjs
index 4bc5abb..4bac17a 100644
--- a/src/gateway/public-gateway.mjs
+++ b/src/gateway/public-gateway.mjs
@@ -1783,6 +1783,10 @@ const server = http.createServer(async (req, res) => {
         if (!v.ok) { res.writeHead(502); res.end(JSON.stringify({ error: v.error, ...(v.detail || {}) })); return; }
         const hostEntry = askedHost ? hostOverride(manifest, raw, name) : null;
         const hostDns = hostEntry && typeof hostEntry.dns === "object" ? hostEntry.dns : null;
+        // Clients that serve a subdomain themselves — Theseus talks straight to
+        // an `ip` record rather than proxying through here — need the routing
+        // half too, and must not re-implement manifest verification to get it.
+        const hostAct = askedHost ? hostAction(hostEntry) : null;
         // Verified. Cache the seq and hand back the DNS block.
         _dnsSeqCache.set(name, manifest.seq);
         res.setHeader("Cache-Control", "public, max-age=30");
@@ -1790,6 +1794,7 @@ const server = http.createServer(async (req, res) => {
         res.end(JSON.stringify({
           name,
           host: askedHost || null,
+          host_action: hostAct,
           seq: manifest.seq,
           updated_at: manifest.updated_at ?? null,
           // A host that declares its own dns block owns its record set outright