diff --git a/src/main.rs b/src/main.rs
index cd7979d..d9bcaa5 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -438,6 +438,16 @@ fn fetch_asset_handler(c: Conn, _n: Next) -> Conn {
     }
 }
 
+/// Fallback for any request the router didn't match. Deliberately terse -
+/// no route list, no hint of the `/assets/:package/:version/:filename`
+/// shape, nothing to make this service more discoverable to strangers
+/// than it already is. Just enough to not look like a hung connection.
+fn not_found_handler(c: Conn, _n: Next) -> Conn {
+    c.put_status(404)
+        .put_header("content-type", "text/plain")
+        .put_body("404 not found")
+}
+
 fn main() {
     let Some(port) = run_cli() else { return };
 
@@ -451,6 +461,6 @@ fn main() {
 
     println!("C3 on 0.0.0.0:{port}...");
     let cfg = Config::new(format!("0.0.0.0:{port}").parse().unwrap());
-    let pipeline = Pipeline::new().plug(router);
+    let pipeline = Pipeline::new().plug(router).plug(not_found_handler);
     serve_with(cfg, pipeline).unwrap();
 }