diff --git a/README.md b/README.md
index f548cdb..ea0c82a 100644
--- a/README.md
+++ b/README.md
@@ -86,6 +86,9 @@ See <https://llmstxt.org> for the convention.
 
 ### 2. Point at it
 
+In your page's `<head>` (a `<link>` in the body is ignored, so page content can't redirect the
+reader):
+
 ```html
 <link rel="llms" href="/llms.txt" />
 ```
diff --git a/src/human-machine-swapper.js b/src/human-machine-swapper.js
index 99b02c7..8c712a0 100644
--- a/src/human-machine-swapper.js
+++ b/src/human-machine-swapper.js
@@ -49,7 +49,9 @@
   }
 
   function linkedHref() {
-    const link = document.querySelector('link[rel="llms"]');
+    // <head> only: the reader fetches this URL with same-origin cookies, so markup that page
+    // content can inject (a <link> in the body) must not be able to choose it.
+    const link = document.head && document.head.querySelector('link[rel="llms"]');
     return link ? link.getAttribute("href") : null;
   }
 
diff --git a/test/component.test.mjs b/test/component.test.mjs
index a6785b3..dfd1a97 100644
--- a/test/component.test.mjs
+++ b/test/component.test.mjs
@@ -120,3 +120,9 @@ test("it sends cookies to its own origin, so the reader works behind a login", (
   assert.equal((SOURCE.match(/credentials:\s*"same-origin"/g) || []).length, 2);
 });
 
+test("the discovery link is read from <head> only", () => {
+  // The reader fetches that URL with same-origin cookies; body markup must not choose it.
+  assert.ok(/document\.head\.querySelector\('link\[rel="llms"\]'\)/.test(SOURCE));
+  assert.ok(!/document\.querySelector\('link\[rel="llms"\]'\)/.test(SOURCE));
+});
+