diff --git a/serving/fleet-manager/webauthn.go b/serving/fleet-manager/webauthn.go
index 6500a8d..1c927f0 100644
--- a/serving/fleet-manager/webauthn.go
+++ b/serving/fleet-manager/webauthn.go
@@ -196,7 +196,7 @@ func newWebAuthn(cfg config) (*webauthn.WebAuthn, error) {
 	// the direct :9500 form and a 443-proxy form — since passkeys bind to the
 	// exact scheme://host:port the browser used. Each must match a real origin.
 	var origins []string
-	for _, o := range strings.Split(cfg.rpOrigin, ",") {
+	for o := range strings.SplitSeq(cfg.rpOrigin, ",") {
 		if o = strings.TrimSpace(o); o != "" {
 			origins = append(origins, o)
 		}