Always trying new things, so I installed the “WPGraphQL JWT Authentication” plugin for WordPress, and it somehow seems to strip Location headers off WordPress’s JSON API responses. Found out because my slightly convoluted IndieAuth setup stopped working.