diff --git a/apps/api/src/favorites/icon-discovery.service.ts b/apps/api/src/favorites/icon-discovery.service.ts
index 1d741dd..83ecff3 100644
--- a/apps/api/src/favorites/icon-discovery.service.ts
+++ b/apps/api/src/favorites/icon-discovery.service.ts
@@ -330,7 +330,11 @@ export class IconDiscoveryService {
     const url = new URL(iconUrl);
 
     const result = await fetchWithRedirectGuard(url, {
-      accept: 'image/*',
+      // A bare "image/*" Accept header (paired with our non-browser
+      // User-Agent) trips bot-mitigation WAFs on some sites (observed:
+      // chatgpt.com/favicon.ico returns 403 with this combo) — a realistic
+      // browser-style image Accept list avoids that false positive.
+      accept: 'image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8',
       timeoutMs: ICON_FETCH_TIMEOUT_MS,
     });