diff --git a/src/Bifrost.Web/Features/Heimdall/HeimdallAuthService.cs b/src/Bifrost.Web/Features/Heimdall/HeimdallAuthService.cs
index b34a21d..87ffdfd 100644
--- a/src/Bifrost.Web/Features/Heimdall/HeimdallAuthService.cs
+++ b/src/Bifrost.Web/Features/Heimdall/HeimdallAuthService.cs
@@ -83,7 +83,7 @@ public sealed class HeimdallAuthService(
                 detail += ", " + code;
             }
         }
-        catch (Exception) when (!cancellationToken.IsCancellationRequested)
+        catch (Exception error) when (error is not OperationCanceledException)
         {
         }
 
@@ -121,10 +121,12 @@ public sealed class HeimdallAuthService(
             new HeimdallHandoff("browser_completion"),
             entitlementPolicy);
 
-        var response = await httpClient.PostAsJsonAsync(
-            $"/v1/oauth/{provider}/start",
-            request,
-            cancellationToken);
+        // Headers only: a refusal body is read through RefusedStartMessageAsync's own 4 KiB bound, not buffered whole.
+        using var startMessage = new HttpRequestMessage(HttpMethod.Post, $"/v1/oauth/{provider}/start")
+        {
+            Content = JsonContent.Create(request)
+        };
+        using var response = await httpClient.SendAsync(startMessage, HttpCompletionOption.ResponseHeadersRead, cancellationToken);
 
         if (!response.IsSuccessStatusCode)
         {
diff --git a/tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs b/tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs
index da9463a..9f91425 100644
--- a/tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs
+++ b/tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs
@@ -1172,7 +1172,7 @@ public sealed class HeimdallCompletionTests
     [InlineData("text/html; charset=windows-1252")]
     [InlineData("text/html; charset=bogus")]
     [InlineData("text/html; charset=utf-7")]
-    public async Task A_refusal_whose_body_cannot_be_decoded_still_redirects_with_the_status(string contentType)
+    public async Task A_refusal_with_an_unusual_charset_still_redirects_with_the_status(string contentType)
     {
         using var host = new HeimdallHost();
         host.Heimdall.StartStatus = HttpStatusCode.BadGateway;