The shared enrollment_uri/print_enrollment now take the CA the link should carry, for ai-app's iris client -- an APK cross-compiled somewhere other than the machine its server runs on, which therefore cannot pin at build time. This app is built on the machine it talks to, so it passes None and its QR is unchanged; the reason is written at the call site. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>