diff --git a/zz_altcha.rb b/zz_altcha.rb
index 129ec20..dd0a2c0 100644
--- a/zz_altcha.rb
+++ b/zz_altcha.rb
@@ -210,8 +210,14 @@ Rails.application.config.to_prepare do
 
       private
 
+      # Not a real HTTP redirect -- these are JSON API clients (app
+      # backends), not browsers, so a 3xx + Location header either gets
+      # silently ignored or blindly followed into an HTML page where the
+      # app expected JSON, which is worse than just failing. A descriptive
+      # `error` message is what actually reaches a human: most Mastodon
+      # apps surface that string on-screen when a request fails.
       def block_api_account_creation
-        forbidden
+        render json: { error: "Account creation via the API is disabled on this server. Please sign up at #{new_user_registration_url}." }, status: 403
       end
     end
   end