diff --git a/dev2/dev2-site b/dev2/dev2-site
index 1e87ce4..37d9da4 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -1539,6 +1539,10 @@ def render_vhost(s):
     for p in proxies:  # one more server block per proxied host, same certificate
         blk = tmpl("nginx-vhost.conf").split("server {", 2)[2]  # the 443 block only
         blk = "server {" + proxy_tuned(blk, p).replace("__SITE__", s["site"]).replace("__APP_PORT__", str(p["port"])).replace("__SERVER_NAMES__", p["host"])
+        if p.get("locations"):  # host-specific locations ahead of its catch-all (social.w3bs.org's PDS paths)
+            anchor = "    location / {\n        proxy_pass"
+            if blk.count(anchor) != 1: die(f"{p['host']}: cannot find the proxied `location /` to insert locations before")
+            blk = blk.replace(anchor, p["locations"].rstrip("\n") + "\n\n" + anchor)
         conf += "\n# " + p["host"] + " -> 127.0.0.1:" + str(p["port"]) + "\n" + blk
         conf += "\nserver {\n    listen 80;\n    listen [::]:80;\n    server_name " + p["host"] + ";\n    return 301 https://$host$request_uri;\n}\n"
     return keepalive_upstreams(conf, s["site"]), domains
diff --git a/dev2/sites.d/w3bs.org.json b/dev2/sites.d/w3bs.org.json
index 46a87f2..ac5e0c6 100644
--- a/dev2/sites.d/w3bs.org.json
+++ b/dev2/sites.d/w3bs.org.json
@@ -1,12 +1,13 @@
 {
   "bbs_note": "w3bs.org/bbs is the tsbb board in ~/www/w3bs.org-bbs (port 3341, vault w3bs-org-bbs--prod). It follows tsbb releases on its own.",
   "nginx_locations": "    # w3bs.org/bbs: the tsbb board in ~/www/w3bs.org-bbs (TSBB_BASE_URL=https://w3bs.org/bbs).\n    # The path is passed through unstripped: tsbb (>= 0.9.0) mounts itself under it.\n    location ~ ^/bbs(/|$) {\n        proxy_pass http://127.0.0.1:3341;\n        proxy_http_version 1.1;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n        proxy_set_header X-Forwarded-Host $host;\n        proxy_read_timeout 300s;\n    }\n",
-  "social_note": "social.w3bs.org (+ *.social.w3bs.org handles) is the AT Protocol PDS in ~/www/w3bs.org-social (port 3342, vault w3bs-org-social--prod); w3bs.org/social is the app's page about it.",
+  "social_note": "social.w3bs.org is the Bluesky web client (social-app's bskyweb, ~/www/w3bs.org-social-web, port 3343) with the AT Protocol PDS paths (/xrpc, /oauth, /@atproto, /.well-known, /account) sent to the PDS in ~/www/w3bs.org-social (port 3342, vault w3bs-org-social--prod); *.social.w3bs.org handle hosts go straight to the PDS. w3bs.org/social is the app's page about it.",
   "proxies": [
     {
       "host": "social.w3bs.org",
-      "port": 3342,
-      "max_body": "100m"
+      "port": 3343,
+      "max_body": "100m",
+      "locations": "    # AT Protocol PDS (port 3342); everything else is the web client.\n    location /xrpc/ {\n        proxy_pass http://127.0.0.1:3342;\n        proxy_http_version 1.1;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n        proxy_set_header Upgrade $http_upgrade;\n        proxy_set_header Connection $connection_upgrade;\n        proxy_read_timeout 3600s;\n        proxy_send_timeout 3600s;\n        proxy_buffering off;\n    }\n    location /oauth/ {\n        proxy_pass http://127.0.0.1:3342;\n        proxy_http_version 1.1;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n        proxy_set_header Upgrade $http_upgrade;\n        proxy_set_header Connection $connection_upgrade;\n        proxy_read_timeout 3600s;\n        proxy_send_timeout 3600s;\n        proxy_buffering off;\n    }\n    location /@atproto/ {\n        proxy_pass http://127.0.0.1:3342;\n        proxy_http_version 1.1;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n        proxy_set_header Upgrade $http_upgrade;\n        proxy_set_header Connection $connection_upgrade;\n        proxy_read_timeout 3600s;\n        proxy_send_timeout 3600s;\n        proxy_buffering off;\n    }\n    location /.well-known/ {\n        proxy_pass http://127.0.0.1:3342;\n        proxy_http_version 1.1;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n        proxy_set_header Upgrade $http_upgrade;\n        proxy_set_header Connection $connection_upgrade;\n        proxy_read_timeout 3600s;\n        proxy_send_timeout 3600s;\n        proxy_buffering off;\n    }\n    location = /account {\n        proxy_pass http://127.0.0.1:3342;\n        proxy_http_version 1.1;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n        proxy_set_header Upgrade $http_upgrade;\n        proxy_set_header Connection $connection_upgrade;\n        proxy_read_timeout 3600s;\n        proxy_send_timeout 3600s;\n        proxy_buffering off;\n    }\n    location /account/ {\n        proxy_pass http://127.0.0.1:3342;\n        proxy_http_version 1.1;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n        proxy_set_header Upgrade $http_upgrade;\n        proxy_set_header Connection $connection_upgrade;\n        proxy_read_timeout 3600s;\n        proxy_send_timeout 3600s;\n        proxy_buffering off;\n    }\n"
     },
     {
       "host": "*.social.w3bs.org",