diff --git a/scripts/patch-mastodon-well-known.mjs b/scripts/patch-mastodon-well-known.mjs
new file mode 100644
index 00000000..09d63551
--- /dev/null
+++ b/scripts/patch-mastodon-well-known.mjs
@@ -0,0 +1,32 @@
+/**
+ * Patch @indiekit/endpoint-auth to remove its /.well-known/oauth-authorization-server
+ * handler so the Mastodon router's handler (with correct /oauth/authorize endpoint)
+ * takes precedence. endpoint-auth registers first in Express, winning over the
+ * Mastodon router — this removes the conflicting registration.
+ */
+
+import { readFileSync, writeFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { join, dirname } from "node:path";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const pkg = join(__dirname, "../node_modules/@indiekit/endpoint-auth/index.js");
+let src = readFileSync(pkg, "utf-8");
+
+const MARKER = "// patch-mastodon-well-known: removed";
+if (src.includes(MARKER)) {
+  console.log("[patch-mastodon-well-known] Already applied");
+  process.exit(0);
+}
+
+const OLD = `router.get("/oauth-authorization-server", metadataController);`;
+const NEW = `${MARKER}`;
+
+if (!src.includes(OLD)) {
+  console.error("[patch-mastodon-well-known] Target line not found — check endpoint-auth version");
+  process.exit(1);
+}
+
+src = src.replace(OLD, NEW);
+writeFileSync(pkg, src, "utf-8");
+console.log("[patch-mastodon-well-known] Removed endpoint-auth well-known handler; Mastodon router takes over");