diff --git a/net/device_bound_sessions/registration_fetcher.cc b/net/device_bound_sessions/registration_fetcher.cc
index 214e2b2f48e9b..91649e92071df 100644
--- a/net/device_bound_sessions/registration_fetcher.cc
+++ b/net/device_bound_sessions/registration_fetcher.cc
@@ -721,13 +721,16 @@ class RegistrationFetcherImpl : public RegistrationFetcher {
 
     // Session::CreateIfValid confirms that the registration endpoint is
     // same-site with the scope origin. But we still need to validate
-    // that this subdomain is allowed to register a session for the
-    // whole site.
+    // that this subdomain is allowed to register a session for another
+    // origin. This applies whether or not include_site is set: an
+    // include_site=false session with a spoofed scope.origin on a sibling
+    // subdomain is just as cross-origin as an include_site=true session,
+    // and must be authorized via .well-known on the target host.
     if (features::kDeviceBoundSessionsCheckSubdomainRegistration.Get() &&
-        !IsForRefreshRequest() && params_or_error->scope.include_site &&
-        // Skip all validations if the fetcher endpoint is not a subdomain but
-        // rather the top-level site (which matches the origin when including
-        // the site).
+        !IsForRefreshRequest() &&
+        // Skip all validations if the fetcher endpoint host already matches
+        // the session's scope origin host (the only case that needs no
+        // cross-host authorization).
         fetcher_endpoint_.GetHost() != session->origin().host()) {
       GURL::Replacements replacements;
       replacements.SetPathStr("/.well-known/device-bound-sessions");