diff --git a/src/routes/api/autumn/$.ts b/src/routes/api/autumn/$.ts
index 60adbc6..fb95f52 100644
--- a/src/routes/api/autumn/$.ts
+++ b/src/routes/api/autumn/$.ts
@@ -60,9 +60,13 @@ async function handleAutumnRequest(request: Request) {
   // loadHandler(), avoids autumn-js throwing "secret key not found" deep
   // inside the handler once a client request reaches it.
   if (!isHostedAuthMode(env.AUTH_MODE) || !env.AUTUMN_SECRET_KEY?.trim()) {
-    return new Response("Not found", {
-      status: 404,
-    });
+    // JSON, not a plain-text body: the client-side autumn-js hooks call
+    // response.json() on every response regardless of status, and a
+    // non-JSON body throws a SyntaxError there instead of handling the 404.
+    return Response.json(
+      { message: "Not found", code: "not_found" },
+      { status: 404 },
+    );
   }
 
   let context;