diff --git a/src/gateway/public-gateway.mjs b/src/gateway/public-gateway.mjs
index 28657bf..6f74112 100644
--- a/src/gateway/public-gateway.mjs
+++ b/src/gateway/public-gateway.mjs
@@ -822,7 +822,12 @@ async function serve(res, name, reqPath, baseHref, req = null) {
   // is injected only there. The trust chip is injected on BOTH forms (chip
   // is purely informative and useful on mobile where URL bars hide the
   // subdomain structure).
-  const htmlOpts = { pathForm: baseHref !== null, name, reqPath };
+  // Resolver clients (Theseus, Ariadne) fetch a page through the path form and
+  // show it under the name's own origin, so the relay chrome would be a false
+  // warning inside them. They say who they are with "x-bns-policy: client"; a
+  // browser navigation cannot send that header, so visitors still get it.
+  const fromClient = String(req?.headers?.["x-bns-policy"] || "").toLowerCase() === "client";
+  const htmlOpts = { pathForm: baseHref !== null, name: fromClient ? null : name, reqPath };
   // Security headers for every HTML response below. Also strips the broad
   // `access-control-allow-origin: *` set at the top of serve() — HTML pages
   // being readable cross-origin is a surveillance surface (any site can