diff --git a/cmd/specsrht/main.go b/cmd/specsrht/main.go
index cd46b92445598f3323bf8172eae9cada76f17043..8d678a15609bec4a671e88bcb8c3405c01d7d5e7 100644
--- a/cmd/specsrht/main.go
+++ b/cmd/specsrht/main.go
@@ -357,11 +357,18 @@ 	// NewAuthConfig/FilterWebhooks (which refuse cookie auth) accept them.
 	// WithQueues starts the webhook delivery worker with a context carrying that
 	// same stack; the queue executes a subscription's stored query against the
 	// shared schema at delivery time.
+	// The scope list must be an empty slice and not nil. core-go serves it
+	// verbatim at /query/api-meta.json, where a nil slice marshals to
+	// `"scopes": null` — and meta.sr.ht's OAuth page iterates that field for
+	// every service it discovers, so one null there is a 500 on
+	// /oauth2/personal-token for the whole instance, not a degraded entry.
+	// Empty is also the honest answer: this service is owner-only (see
+	// ownerOnly above) and defines no AccessScope enum to grant against.
 	webhookQueue := webhooks.NewQueue(surf.schema, conf)
 	srv := coreserver.New(serviceName, defaultBind, conf, os.Args).
 		WithDefaultMiddleware().
 		WithMiddleware(ownerOnly(cfg.Instance.OwnerName)).
-		WithSchema(surf.schema, nil).
+		WithSchema(surf.schema, []string{}).
 		WithQueues(webhookQueue.Queue)
 	mountRoutes(srv.AnonRouter(), conf, surf)