diff --git a/server/src/auth.rs b/server/src/auth.rs
index 06eb5f2..ec1a3b6 100644
--- a/server/src/auth.rs
+++ b/server/src/auth.rs
@@ -47,8 +47,14 @@ pub use wg_app_link::enroll::{generate_token, token_hash_hex};
 /// where to connect and the bearer token. The CA stays embedded in the APK,
 /// so this carries no trust material -- photographing the terminal leaks
 /// only the token, which is rotatable (`--rotate-token`).
+///
+/// `None` for the shared function's optional CA, deliberately: this app is
+/// built on the machine it talks to and pins that build's certificate, so
+/// carrying the CA here would only cost the QR the extra 48 columns
+/// `enroll::ca_param` documents. ai-app passes one because its iris client
+/// is cross-compiled elsewhere.
 pub fn print_enrollment(host: IpAddr, port: u16, token: &str) -> anyhow::Result<()> {
-    wg_app_link::enroll::print_enrollment(ENROLL_SCHEME, host, port, token)
+    wg_app_link::enroll::print_enrollment(ENROLL_SCHEME, host, port, token, None)
 }
 
 pub async fn require_token(
diff --git a/vendor/wg-app-link b/vendor/wg-app-link
index f95bc77..22ec18f 160000
--- a/vendor/wg-app-link
+++ b/vendor/wg-app-link
@@ -1 +1 @@
-Subproject commit f95bc77f7bf55a57ba6c051b06f11d30ac68c55e
+Subproject commit 22ec18fcf27789f504f71e4c8ff449c554ee076d