diff --git a/internal/appstore/bag.go b/internal/appstore/bag.go
index 1337269d1..46c2366b6 100644
--- a/internal/appstore/bag.go
+++ b/internal/appstore/bag.go
@@ -27,11 +27,11 @@ func (c *Client) bag() (SAPConfig, error) {
 		return SAPConfig{}, err
 	}
 
-	url := fmt.Sprintf("https://%s%s?guid=%s", initDomain, initPath, g)
+	bagURL := fmt.Sprintf("https://%s%s?guid=%s", initDomain, initPath, g)
 
 	var out bagResult
 
-	res, err := c.send(http.MethodGet, url, map[string]string{"Accept": "application/xml"}, nil, nil, formatXML, &out)
+	res, err := c.send(http.MethodGet, bagURL, map[string]string{"Accept": "application/xml"}, nil, nil, formatXML, &out)
 	if err != nil {
 		return SAPConfig{}, fmt.Errorf("bag: %w", err)
 	}
@@ -57,6 +57,16 @@ func (c *Client) bag() (SAPConfig, error) {
 		return SAPConfig{}, fmt.Errorf("bag: %w", err)
 	}
 
+	authEndpoint, err := url.Parse(config.AuthEndpoint)
+	if err != nil {
+		return SAPConfig{}, fmt.Errorf("bag: parse authentication endpoint: %w", err)
+	}
+
+	// The bare path returns unusable responses (204/301/HTML); Apple only
+	// answers the signed authenticate request on the slashed path.
+	authEndpoint.Path = PrivateAppStoreAPIPathAuth + "/"
+	config.AuthEndpoint = authEndpoint.String()
+
 	return config, nil
 }
 
@@ -98,7 +108,7 @@ func validateAuthenticationEndpoint(endpoint string) error {
 		return fmt.Errorf("unsupported authentication endpoint %q", endpoint)
 	}
 
-	if parsed.Path != PrivateAppStoreAPIPathAuth {
+	if parsed.Path != PrivateAppStoreAPIPathAuth && parsed.Path != PrivateAppStoreAPIPathAuth+"/" {
 		return fmt.Errorf("unsupported authentication endpoint %q", endpoint)
 	}
 
diff --git a/internal/appstore/client.go b/internal/appstore/client.go
index c172e3c65..c1506a02e 100644
--- a/internal/appstore/client.go
+++ b/internal/appstore/client.go
@@ -24,7 +24,7 @@ func New(cookiesFile string) (*Client, error) {
 	hc := &http.Client{
 		Jar: jar,
 		CheckRedirect: func(req *http.Request, via []*http.Request) error {
-			if req.Referer() == authURL {
+			if strings.TrimSuffix(req.Referer(), "/") == authURL {
 				return http.ErrUseLastResponse
 			}