diff --git a/src/gateway/public-gateway.mjs b/src/gateway/public-gateway.mjs
index 1403e27..6443acd 100644
--- a/src/gateway/public-gateway.mjs
+++ b/src/gateway/public-gateway.mjs
@@ -619,7 +619,13 @@ async function serve(res, name, reqPath, baseHref, req = null) {
       });
       return res.end();
     }
-    if (refuse || !hasBlockAck(req, entry.name)) {
+    // A resolver client (Theseus, Ariadne) fetches a site's files itself and
+    // shows its OWN warning with its own "continue"; it cannot use this one,
+    // having no cookie jar and a different origin. It says so with
+    // "x-bns-policy: client", and the gateway then stays out of the way. A
+    // browser navigation cannot send that header, so visitors are still warned.
+    const clientDecides = String(req?.headers?.["x-bns-policy"] || "").toLowerCase() === "client";
+    if (refuse || (!clientDecides && !hasBlockAck(req, entry.name))) {
       u.searchParams.set("bns-proceed", "1");
       res.writeHead(refuse ? 451 : 403, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
       return res.end(blockPage(entry, refuse ? null : `${root}${u.pathname}${u.search}`));