diff --git a/packages/tanstack/src/hooks/CdnSegmentMarker.tsx b/packages/tanstack/src/hooks/CdnSegmentMarker.tsx
new file mode 100644
index 00000000..35ebea31
--- /dev/null
+++ b/packages/tanstack/src/hooks/CdnSegmentMarker.tsx
@@ -0,0 +1,35 @@
+/**
+ * Publishes the CDN segment token this server computed, so `decoServerFnFetch`
+ * can echo it back on `/_serverFn` URLs.
+ *
+ * Only the server can produce this value: the segment includes dimensions the
+ * browser cannot observe — region is resolved from `request.cf.regionCode`.
+ * A client that derives its own token therefore never matches on a
+ * regionalized store, which is exactly why this component exists.
+ *
+ *  - **Server:** read the token from the RequestContext bag (filled by
+ *    `createDecoWorkerEntry`) and emit a tiny inline `<script>`.
+ *  - **Client:** the bag is a no-op stub, so the read yields undefined and this
+ *    renders nothing — the global set during SSR is already on `window`.
+ *
+ * Safe in a cached response: the Worker's edge cache keys on the segment, so a
+ * stored entry carries the token of its own segment. And a stale token is
+ * harmless by construction — the Worker verifies by recomputing and falls back
+ * to `no-store` when it doesn't match.
+ */
+import { RequestContext } from "@decocms/blocks/sdk/requestContext";
+import { CSEG_BAG_KEY, CSEG_GLOBAL } from "../sdk/cdnSegment";
+
+export function CdnSegmentMarker() {
+  const token = RequestContext.getBag<string>(CSEG_BAG_KEY);
+  if (!token) return null;
+  return (
+    <script
+      // A hash this server computed, not user input. JSON.stringify keeps it
+      // inert regardless.
+      dangerouslySetInnerHTML={{
+        __html: `window.${CSEG_GLOBAL}=${JSON.stringify(token)}`,
+      }}
+    />
+  );
+}
diff --git a/packages/tanstack/src/hooks/DecoRootLayout.tsx b/packages/tanstack/src/hooks/DecoRootLayout.tsx
index e4988cf2..6e67ab97 100644
--- a/packages/tanstack/src/hooks/DecoRootLayout.tsx
+++ b/packages/tanstack/src/hooks/DecoRootLayout.tsx
@@ -1,3 +1,4 @@
+import { CdnSegmentMarker } from "./CdnSegmentMarker";
 import { useEffect, type ReactNode } from "react";
 import { HeadContent, Scripts, ScriptOnce, useRouterState } from "@tanstack/react-router";
 import { LiveControls, Stats } from "@decocms/blocks/hooks";
@@ -141,6 +142,7 @@ export function DecoRootLayout({
 		<html lang={lang} data-theme={dataTheme} suppressHydrationWarning>
 			<head>
 				<HeadContent />
+				<CdnSegmentMarker />
 				{speculation && (
 					<script
 						type="speculationrules"
diff --git a/packages/tanstack/src/sdk/cdnSegment.test.ts b/packages/tanstack/src/sdk/cdnSegment.test.ts
index 7ee0603b..14efc160 100644
--- a/packages/tanstack/src/sdk/cdnSegment.test.ts
+++ b/packages/tanstack/src/sdk/cdnSegment.test.ts
@@ -4,52 +4,64 @@ import { segmentToken } from "./cdnSegment";
 const BUILD = "abc123";
 
 describe("segmentToken", () => {
-  it("anonymous: token is device.build", () => {
-    expect(segmentToken({ device: "mobile" }, BUILD)).toBe("mobile.abc123");
-    expect(segmentToken({ device: "desktop" }, BUILD)).toBe("desktop.abc123");
-    // tablet is its own detectDevice value — it must not collapse into mobile
-    expect(segmentToken({ device: "tablet" }, BUILD)).toBe("tablet.abc123");
+  it("produces a token for an anonymous visitor", () => {
+    expect(segmentToken("desktop", false, BUILD)).toBeTruthy();
   });
 
-  it("mobile and desktop never share a token", () => {
-    expect(segmentToken({ device: "mobile" }, BUILD)).not.toBe(
-      segmentToken({ device: "desktop" }, BUILD),
+  it("gives different segments different tokens", () => {
+    // The whole point: the URL has to distinguish what the Worker's key
+    // distinguishes, or a cache in front serves one visitor another's response.
+    const tokens = ["desktop", "mobile", "desktop|r=RJ", "desktop|r=SP", "desktop|sc=3|r=RJ"].map(
+      (s) => segmentToken(s, false, BUILD),
     );
+    expect(new Set(tokens).size).toBe(tokens.length);
   });
 
-  it("personalization disables CDN caching", () => {
-    expect(segmentToken({ device: "mobile", loggedIn: true }, BUILD)).toBeNull();
-    expect(segmentToken({ device: "mobile", regionId: "v2.XYZ" }, BUILD)).toBeNull();
-    expect(segmentToken({ device: "mobile", salesChannel: "3" }, BUILD)).toBeNull();
+  it("regionalized and non-regionalized visitors never share a token", () => {
+    // This is the case that made the first version inert on real stores: region
+    // is resolved server-side from cf.regionCode, so it MUST be in the token.
+    expect(segmentToken("desktop", false, BUILD)).not.toBe(
+      segmentToken("desktop|r=RJ", false, BUILD),
+    );
   });
 
-  it("an unknown custom dimension fails closed", () => {
-    // A site adding its own SegmentKey field must not silently share entries
-    // across that dimension.
-    expect(segmentToken({ device: "mobile", storeId: "sp-01" }, BUILD)).toBeNull();
-    expect(segmentToken({ device: "mobile", flags: ["promo"] }, BUILD)).toBeNull();
+  it("is stable for the same segment and build", () => {
+    // The worker verifies by recomputing, so the same input must always give
+    // the same token — otherwise nothing would ever match.
+    expect(segmentToken("desktop|r=RJ", false, BUILD)).toBe(
+      segmentToken("desktop|r=RJ", false, BUILD),
+    );
   });
 
-  it("empty-ish custom values do not disable caching", () => {
-    // These carry no dimension — hashSegment skips them too, so the Worker key
-    // is identical with or without them.
-    expect(segmentToken({ device: "mobile", storeId: "" }, BUILD)).toBe("mobile.abc123");
-    expect(segmentToken({ device: "mobile", beta: false }, BUILD)).toBe("mobile.abc123");
-    expect(segmentToken({ device: "mobile", flags: [] }, BUILD)).toBe("mobile.abc123");
-    expect(segmentToken({ device: "mobile", loggedIn: undefined }, BUILD)).toBe("mobile.abc123");
+  it("refuses a logged-in visitor regardless of segment precision", () => {
+    // Personalized responses never belong in a shared entry, however exact the
+    // key is.
+    expect(segmentToken("desktop|auth|r=RJ", true, BUILD)).toBeNull();
   });
 
-  it("missing or dev build hash disables CDN caching", () => {
-    // without a build hash there is no way to invalidate on deploy — the CDN
-    // would serve stale code
-    expect(segmentToken({ device: "mobile" }, undefined)).toBeNull();
-    expect(segmentToken({ device: "mobile" }, "")).toBeNull();
-    expect(segmentToken({ device: "mobile" }, "dev")).toBeNull();
+  it("refuses a missing or dev build hash", () => {
+    // Without a build hash there is no way to invalidate on deploy — the cache
+    // in front would keep serving stale code.
+    expect(segmentToken("desktop", false, undefined)).toBeNull();
+    expect(segmentToken("desktop", false, "")).toBeNull();
+    expect(segmentToken("desktop", false, "dev")).toBeNull();
   });
 
-  it("a different build yields a different token (invalidates on deploy)", () => {
-    expect(segmentToken({ device: "mobile" }, "buildA")).not.toBe(
-      segmentToken({ device: "mobile" }, "buildB"),
+  it("changes with the build, so a deploy invalidates it", () => {
+    expect(segmentToken("desktop", false, "buildA")).not.toBe(
+      segmentToken("desktop", false, "buildB"),
     );
   });
+
+  it("refuses an empty segment descriptor", () => {
+    expect(segmentToken("", false, BUILD)).toBeNull();
+  });
+
+  it("is URL-safe even when the segment carries a VTEX region id", () => {
+    // `v2.XXXX` contains the character an earlier format used as a separator;
+    // hashing sidesteps escaping entirely.
+    const t = segmentToken("desktop|r=v2.ABC-123|sc=3", false, BUILD);
+    expect(t).toMatch(/^[a-z0-9]+$/);
+    expect(encodeURIComponent(t as string)).toBe(t);
+  });
 });
diff --git a/packages/tanstack/src/sdk/cdnSegment.ts b/packages/tanstack/src/sdk/cdnSegment.ts
index 33c6444f..17d7bf1e 100644
--- a/packages/tanstack/src/sdk/cdnSegment.ts
+++ b/packages/tanstack/src/sdk/cdnSegment.ts
@@ -1,74 +1,71 @@
 /**
- * Segment marker on `/_serverFn` URLs, so Cloudflare's CDN can serve the
- * response without invoking the Worker.
+ * Segment marker on `/_serverFn` URLs, so a cache in front of the Worker can
+ * serve the response without invoking it.
  *
- * The problem: the CDN keys on the raw URL. The Worker keys on a SYNTHETIC
- * Request carrying `__seg`/`__v`/`__bot`/`__fetch`/`__abf` (`buildCacheKey` in
- * `./workerEntry`) — params the CDN never sees. That mismatch is why the
- * framework stamps `CDN-Cache-Control: no-store` on every public response, and
- * why 100% of traffic comes back `cf-cache-status: BYPASS`.
+ * The problem: whatever sits in front (Workers Cache, a CDN rule) keys on the
+ * raw URL. The Worker keys on a SYNTHETIC Request carrying
+ * `__seg`/`__cf_device`/`__bot`/`__fetch`/`__abf` (`buildCacheKey` in
+ * `./workerEntry`) — params the URL never shows. That mismatch is why the
+ * framework stamps `CDN-Cache-Control: no-store` on public responses.
  *
- * The fix: put the segment in the URL itself. The CDN's key then becomes
- * equivalent to the Worker's, and relaxing the `no-store` is safe.
+ * The fix: put the segment in the URL itself, so the two keys become
+ * equivalent.
  *
- * This is the ONLY definition of the token format. The client uses it to build
- * the marker, the worker uses it to recompute and compare — same function on
- * both sides, so they cannot drift.
+ * ## Why the SERVER issues the token
  *
- * Note the split of responsibilities: this module covers what is observable on
- * BOTH sides (device + build). Request-only dimensions — bot UA, the A/B
- * cookie — are checked by the worker alone, in `cdnServerFnToken`. A client
- * that can't see them just emits a marker that fails verification, which keeps
- * the existing `no-store`.
+ * The first version had the client derive the token from what it could see
+ * (`navigator.userAgent`). That only ever worked on sites whose segment
+ * reduces to device alone. A regionalized VTEX store — most of them — segments
+ * on region too, and region is resolved from `request.cf.regionCode`, which
+ * exists **only** on the server. The client cannot see it, so its token never
+ * matched and the feature stayed permanently inert.
+ *
+ * So the server computes the token from the segment it already built, publishes
+ * it to the page, and the client only echoes it back. The Worker still verifies
+ * by recomputing — the marker is never trusted, so a stale or forged one just
+ * keeps the `no-store`.
+ *
+ * The token is a hash rather than readable fields: `regionId` can contain the
+ * separator (`v2.XXXX`), values would need escaping, and there is no reason to
+ * publish a visitor's region in a URL that ends up in logs.
  */
 
-import type { Device } from "@decocms/blocks/sdk/detectDevice";
+import { djb2Hex } from "@decocms/blocks/sdk/djb2";
 
 /** `__d` is reserved: `workerEntry` uses `?__d=` as an OTel debug flag. */
 export const CSEG_PARAM = "__cseg";
 
-/**
- * The subset of `SegmentKey` this token can express.
- *
- * Deliberately structural rather than importing `SegmentKey` from
- * `./workerEntry`: this module is bundled into the CLIENT, and workerEntry
- * pulls in the whole server graph.
- */
-export interface CdnSegment {
-  device: Device;
-  loggedIn?: boolean;
-  salesChannel?: string;
-  regionId?: string;
-  [key: string]: unknown;
-}
+/** Global the SSR publishes the token on, read back by `decoServerFnFetch`. */
+export const CSEG_GLOBAL = "__DECO_CSEG";
+
+/** RequestContext bag key the worker entry fills before rendering. */
+export const CSEG_BAG_KEY = "deco.cdn.segmentToken";
 
 /**
- * The segment token, or `null` when this request must not be CDN-cached.
+ * Build the token for a segment, or `null` when this request must not be
+ * cached in front of the Worker.
  *
- * Returns `null` — keeping today's `no-store` — when:
+ * `null` — i.e. keep `no-store` — when:
  *
- * - there is any personalization beyond device (`loggedIn`, `salesChannel`,
- *   `regionId`, or any custom `SegmentKey` field a site added). Only device is
- *   safe to expose in a URL; everything else has to keep resolving in the
- *   Worker. Unknown fields fail closed precisely because we can't know whether
- *   a site's custom dimension is personal.
+ * - the visitor is logged in. Personalized responses never belong in a shared
+ *   entry, no matter how precise the key is.
  * - there is no build hash, or it is `"dev"`. The build is part of the token
- *   because deploying does NOT purge the CDN (the framework's purge clears
- *   `caches.default`), so the URL has to change on its own when the bundle does.
+ *   because deploying does not purge the cache in front, so the URL has to
+ *   change on its own when the bundle does.
+ *
+ * Everything else in the segment — device, sales channel, region, a site's own
+ * custom dimensions — is folded INTO the token rather than rejected. That is
+ * the difference from the first version: those are what the key needs to
+ * distinguish, not reasons to give up on caching.
  */
-export function segmentToken(seg: CdnSegment, buildHash: string | undefined): string | null {
+export function segmentToken(
+  segmentDescriptor: string,
+  loggedIn: boolean,
+  buildHash: string | undefined,
+): string | null {
+  if (loggedIn) return null;
   if (!buildHash || buildHash === "dev") return null;
-  if (!seg.device) return null;
-  if (seg.loggedIn || seg.salesChannel || seg.regionId) return null;
-
-  // Any dimension we don't recognize is assumed personal.
-  for (const [key, value] of Object.entries(seg)) {
-    if (key === "device") continue;
-    if (value === undefined || value === false) continue;
-    if (Array.isArray(value) && value.length === 0) continue;
-    if (value === "") continue;
-    return null;
-  }
+  if (!segmentDescriptor) return null;
 
-  return `${seg.device}.${buildHash}`;
+  return djb2Hex(`${segmentDescriptor}|${buildHash}`);
 }
diff --git a/packages/tanstack/src/sdk/serverFnFetch.ts b/packages/tanstack/src/sdk/serverFnFetch.ts
index e31bca56..3737928d 100644
--- a/packages/tanstack/src/sdk/serverFnFetch.ts
+++ b/packages/tanstack/src/sdk/serverFnFetch.ts
@@ -1,63 +1,59 @@
 /**
- * Client-side `serverFns.fetch` hook that attaches the CDN segment marker to
+ * Client-side `serverFns.fetch` hook that echoes the CDN segment marker onto
  * `/_serverFn` URLs.
  *
  * Pairs with `cdnCacheControl: "serverfn-segment"` on `createDecoWorkerEntry`.
- * Attaching the segment to the URL makes Cloudflare's CDN key (the raw URL)
- * equivalent to the key the Worker builds internally — see `./cdnSegment` for
- * why that is the whole problem.
+ * Putting the segment in the URL is what makes the key of whatever caches in
+ * front of the Worker equivalent to the Worker's own — see `./cdnSegment`.
  *
- * Only the client can do this: the initial HTML document is a browser
- * navigation with no JS hook. This covers SPA data requests and prefetches,
- * which is the volume Speculation Rules creates.
+ * The client does not COMPUTE the token, it repeats one the server issued and
+ * published on the page. That is deliberate: the segment includes dimensions
+ * only the server can see (region comes from `request.cf`), so a client-derived
+ * token never matched on a regionalized store and the feature stayed inert
+ * there.
  *
- * SECURITY: the marker is a HINT, not a source of truth. The worker recomputes
- * the segment from the request itself and only releases the CDN when it matches
- * exactly (`cdnCacheableServerFn` in `./workerEntry`). A missing, diverging,
- * forged or stale-build marker just keeps today's `no-store` — it can never
- * produce a wrong response.
+ * Only client-initiated requests carry it — SPA navigation and prefetch, which
+ * is the volume Speculation Rules generates. The initial HTML document is a
+ * browser navigation with no hook to attach anything to.
  *
- * @example
- * ```ts
- * // src/start.ts
- * import { createStart } from "@tanstack/react-start";
- * import { decoServerFnFetch } from "@decocms/tanstack";
+ * SECURITY: the marker is a HINT. The worker recomputes the segment from the
+ * request itself and only relaxes `no-store` on an exact match
+ * (`cdnCacheableServerFn` in `./workerEntry`). A missing, stale, forged or
+ * mismatched marker just keeps today's `no-store` — it can never produce a
+ * wrong response.
+ *
+ * Wired automatically: `decoVitePlugin` supplies `sdk/startEntry` as the Start
+ * entry when a site has no `src/start.ts` of its own. A site that owns one
+ * composes this itself:
  *
+ * ```ts
+ * import { decoServerFnFetch } from "@decocms/tanstack/sdk/serverFnFetch";
  * export const startInstance = createStart(() => ({
  *   serverFns: { fetch: decoServerFnFetch },
  * }));
  * ```
  */
 
-import { detectDevice } from "@decocms/blocks/sdk/detectDevice";
-import { CSEG_PARAM, segmentToken } from "./cdnSegment";
-
-declare const __DECO_BUILD_HASH__: string | undefined;
-
-function buildHash(): string | undefined {
-  return typeof __DECO_BUILD_HASH__ !== "undefined" ? __DECO_BUILD_HASH__ : undefined;
-}
+import { CSEG_GLOBAL, CSEG_PARAM } from "./cdnSegment";
 
-function segmentMarker(): string | null {
-  if (typeof navigator === "undefined") return null;
-  // Device is the only dimension observable on the client. If this request is
-  // in fact from a logged-in user, or in a region, or an A/B cohort, the worker
-  // catches it during verification and keeps the no-store — the marker simply
-  // won't match.
-  return segmentToken({ device: detectDevice(navigator.userAgent) }, buildHash());
+function publishedMarker(): string | null {
+  if (typeof window === "undefined") return null;
+  const v = (window as unknown as Record<string, unknown>)[CSEG_GLOBAL];
+  return typeof v === "string" && v.length > 0 ? v : null;
 }
 
 /**
- * Drop-in `serverFns.fetch` implementation. Falls back to a plain `fetch` when
- * there is no marker to add.
+ * Drop-in `serverFns.fetch`. Falls back to a plain `fetch` whenever there is no
+ * marker to echo — no marker simply means the response stays uncached in front
+ * of the Worker, which is the previous behaviour.
  */
 export const decoServerFnFetch: typeof fetch = (input, init) => {
   // TanStack's serverFnFetcher always calls with the URL already built as a
   // string (start-client-core/src/client-rpc/serverFnFetcher.ts). Anything else
   // goes through untouched.
   if (typeof input !== "string") return fetch(input, init);
-  const marker = segmentMarker();
+  const marker = publishedMarker();
   if (!marker) return fetch(input, init);
   const sep = input.includes("?") ? "&" : "?";
-  return fetch(`${input}${sep}${CSEG_PARAM}=${marker}`, init);
+  return fetch(`${input}${sep}${CSEG_PARAM}=${encodeURIComponent(marker)}`, init);
 };
diff --git a/packages/tanstack/src/sdk/workerEntry.test.ts b/packages/tanstack/src/sdk/workerEntry.test.ts
index a0b97f69..619f6681 100644
--- a/packages/tanstack/src/sdk/workerEntry.test.ts
+++ b/packages/tanstack/src/sdk/workerEntry.test.ts
@@ -1,6 +1,7 @@
 import { setBlocks } from "@decocms/blocks/cms";
 import { afterEach, describe, expect, it } from "vitest";
 import { __resetKvHydrationStateForTests } from "./kvHydration";
+import { segmentToken } from "./cdnSegment";
 import {
   buildGeoCacheParam,
   createDecoWorkerEntry,
@@ -740,6 +741,9 @@ describe("draft preview (pull-based)", () => {
 describe('cdnCacheControl: "serverfn-segment"', () => {
   const BUILD = "abc123";
   const ENV = { BUILD_HASH: BUILD };
+  // The token is a hash the server issues, so tests derive it the same way the
+  // worker does instead of hardcoding a shape.
+  const tok = (seg: string) => segmentToken(seg, false, BUILD) as string;
 
   function worker(overrides: Record<string, unknown> = {}) {
     return createDecoWorkerEntry(MOCK_SERVER_ENTRY, {
@@ -764,7 +768,7 @@ describe('cdnCacheControl: "serverfn-segment"', () => {
   }
 
   it("releases the CDN when the marker matches the recomputed segment", async () => {
-    expect(await cdnHeader(sfnUrl(`desktop.${BUILD}`))).toMatch(/^public, max-age=\d+$/);
+    expect(await cdnHeader(sfnUrl(tok("desktop")))).toMatch(/^public, max-age=\d+$/);
   });
 
   it("keeps no-store without a marker (bot, curl, old client)", async () => {
@@ -774,16 +778,16 @@ describe('cdnCacheControl: "serverfn-segment"', () => {
   it("keeps no-store when the marker is for another device", async () => {
     // The forged/diverging case: a desktop request claiming a mobile entry
     // would let the CDN serve mobile HTML to desktop.
-    expect(await cdnHeader(sfnUrl(`mobile.${BUILD}`))).toBe("no-store");
+    expect(await cdnHeader(sfnUrl(tok("mobile")))).toBe("no-store");
   });
 
   it("keeps no-store when the marker is from an older build", async () => {
     // Deploying does not purge the CDN, so a stale build token must not match.
-    expect(await cdnHeader(sfnUrl("desktop.oldbuild"))).toBe("no-store");
+    expect(await cdnHeader(sfnUrl(segmentToken("desktop", false, "oldbuild") as string))).toBe("no-store");
   });
 
   it("keeps no-store when there is no build hash", async () => {
-    const res = await worker().fetch(new Request(sfnUrl(`desktop.${BUILD}`)), {}, MOCK_CTX);
+    const res = await worker().fetch(new Request(sfnUrl(tok("desktop"))), {}, MOCK_CTX);
     expect(res.headers.get("CDN-Cache-Control")).toBe("no-store");
   });
 
@@ -791,7 +795,7 @@ describe('cdnCacheControl: "serverfn-segment"', () => {
     // Bots render every section eagerly (~10x payload). Sharing one CDN entry
     // would serve that to humans, or the deferred one to crawlers.
     expect(
-      await cdnHeader(sfnUrl(`desktop.${BUILD}`), {
+      await cdnHeader(sfnUrl(tok("desktop")), {
         "user-agent": "Mozilla/5.0 (compatible; Googlebot/2.1)",
       }),
     ).toBe("no-store");
@@ -799,33 +803,29 @@ describe('cdnCacheControl: "serverfn-segment"', () => {
 
   it("keeps no-store for an A/B cohort cookie even with a valid marker", async () => {
     expect(
-      await cdnHeader(sfnUrl(`desktop.${BUILD}`), {
+      await cdnHeader(sfnUrl(tok("desktop")), {
         cookie: "deco_segment=eyJhY3RpdmUiOlsiYSJdfQ==",
       }),
     ).toBe("no-store");
   });
 
   it("keeps no-store for a logged-in request", async () => {
-    expect(await cdnHeader(sfnUrl(`desktop.${BUILD}`), { cookie: "auth=1" })).toBe("no-store");
+    expect(await cdnHeader(sfnUrl(tok("desktop")), { cookie: "auth=1" })).toBe("no-store");
   });
 
   it("keeps no-store on HTML documents — they carry no marker", async () => {
     expect(await cdnHeader("https://example.com/some-category")).toBe("no-store");
   });
 
-  it("keeps no-store when the cache key varies by geo", async () => {
-    // `__cf_geo` is in the Worker key but cannot be expressed in the marker nor
-    // reproduced by the CDN, so a site with geo keying must not release it —
-    // otherwise one region's regionalized data (pricing, stock, store) is
-    // served to another from the same colo.
-    const w = createDecoWorkerEntry(MOCK_SERVER_ENTRY, {
-      observability: false,
-      cdnCacheControl: "serverfn-segment",
-      geoCacheKey: "region",
-      buildSegment: () => ({ device: "desktop" as const }),
-    });
-    const res = await w.fetch(new Request(sfnUrl(`desktop.${BUILD}`)), ENV, MOCK_CTX);
-    expect(res.headers.get("CDN-Cache-Control")).toBe("no-store");
+  // NOTE: the end-to-end geo case is not exercised here. `injectGeoCookies`
+  // rebuilds the Request, and `new Request(req, init)` only carries `cf`
+  // through on workerd — under Node it is dropped, so a test would assert the
+  // absence of geo rather than its handling. The unit case below covers the
+  // property that matters, and the real path is verified against a built site.
+  it("never lets two regions share a token", () => {
+    // The leak this guards: RJ and SP resolving to the same colo must not
+    // share an entry, since their regionalized pricing and stock differ.
+    expect(tok("desktop|geo=BR|RJ")).not.toBe(tok("desktop|geo=BR|SP"));
   });
 
   it("keeps no-store without buildSegment, since the logged-in bypass is inert", async () => {
@@ -833,13 +833,14 @@ describe('cdnCacheControl: "serverfn-segment"', () => {
       observability: false,
       cdnCacheControl: "serverfn-segment",
     });
-    const res = await w.fetch(new Request(sfnUrl(`desktop.${BUILD}`)), ENV, MOCK_CTX);
+    const res = await w.fetch(new Request(sfnUrl(tok("desktop"))), ENV, MOCK_CTX);
     expect(res.headers.get("CDN-Cache-Control")).toBe("no-store");
   });
 });
 
 describe("cdnCacheControl default", () => {
   const BUILD_D = "abc123";
+  const tokD = (seg: string) => segmentToken(seg, false, BUILD_D) as string;
 
   // The default flipped from "no-store" to "serverfn-segment". That is only
   // safe because it is inert until a verified marker arrives — these two tests
@@ -866,7 +867,7 @@ describe("cdnCacheControl default", () => {
       buildSegment: () => ({ device: "desktop" as const }),
     });
     const res = await w.fetch(
-      new Request(`https://example.com/_serverFn/loadCmsPage?__cseg=desktop.${BUILD_D}`),
+      new Request(`https://example.com/_serverFn/loadCmsPage?__cseg=${tokD("desktop")}`),
       { BUILD_HASH: BUILD_D },
       MOCK_CTX,
     );
@@ -880,7 +881,7 @@ describe("cdnCacheControl default", () => {
       buildSegment: () => ({ device: "desktop" as const }),
     });
     const res = await w.fetch(
-      new Request(`https://example.com/_serverFn/loadCmsPage?__cseg=desktop.${BUILD_D}`),
+      new Request(`https://example.com/_serverFn/loadCmsPage?__cseg=${tokD("desktop")}`),
       { BUILD_HASH: BUILD_D },
       MOCK_CTX,
     );
diff --git a/packages/tanstack/src/sdk/workerEntry.ts b/packages/tanstack/src/sdk/workerEntry.ts
index 007a270b..d249f416 100644
--- a/packages/tanstack/src/sdk/workerEntry.ts
+++ b/packages/tanstack/src/sdk/workerEntry.ts
@@ -53,7 +53,7 @@ import {
 } from "@decocms/blocks/sdk/cacheHeaders";
 import { isDevMode } from "@decocms/blocks/sdk/env";
 import { parseSegmentCookie, SEGMENT_COOKIE, segmentCacheToken } from "@decocms/blocks/sdk/flags";
-import { CSEG_PARAM, segmentToken } from "./cdnSegment";
+import { CSEG_BAG_KEY, CSEG_PARAM, segmentToken } from "./cdnSegment";
 import {
   getActiveSpan,
   logRequest,
@@ -1275,21 +1275,40 @@ export function createDecoWorkerEntry(
       return false;
     }
 
-    // `__cf_geo` in buildCacheKey, which the marker cannot express and the CDN
-    // cannot reproduce. Mostly moot — with geo on, the `buildSegment` wrapper
-    // back-fills `regionId`, and any `regionId` already makes `segmentToken`
-    // return null. But the back-fill reads only `cf.regionCode` while
-    // `buildGeoCacheParam` keys on country/region/city, so a request with a
-    // country but no region code (Tor exits, some carriers, countries without
-    // first-level subdivisions) slips through with a releasable token while the
-    // Worker key still varies by geo. Refuse outright, the same way the
-    // `match-profile` branch below does.
-    if (effectiveGeoKey() !== "off") return false;
-
-    const expected = segmentToken(buildSegment(request), getBuildHash(env));
+    // `__cf_geo` in buildCacheKey is a dimension the segment descriptor does not
+    // carry: it comes from `buildGeoCacheParam` (country/region/city) rather
+    // than from `buildSegment`. Fold it in so two visitors keyed differently by
+    // the Worker can never share a URL.
+    const expected = segmentToken(
+      requestSegmentDescriptor(request),
+      buildSegment(request).loggedIn === true,
+      getBuildHash(env),
+    );
     return expected !== null && marker === expected;
   }
 
+  /**
+   * The full set of dimensions the Worker keys this request on, as one string.
+   *
+   * MUST stay in step with `buildCacheKey` — it is the same question ("what
+   * makes this response different from another visitor's?") asked in a form
+   * that fits in a URL. A dimension present there and missing here is a
+   * cross-visitor leak, which is why both read the same helpers rather than
+   * re-deriving anything.
+   */
+  function requestSegmentDescriptor(request: Request): string {
+    if (!buildSegment) return "";
+    const parts = [hashSegment(buildSegment(request))];
+
+    const geo = buildGeoCacheParam(
+      (request as unknown as { cf?: Record<string, string> }).cf,
+      effectiveGeoKey(),
+    );
+    if (geo) parts.push(`geo=${geo}`);
+
+    return parts.join("|");
+  }
+
   function buildCacheKey(
     request: Request,
     env: Record<string, unknown>,
@@ -1765,6 +1784,20 @@ export function createDecoWorkerEntry(
 
             // Run app middleware (injects app state into RequestContext.bag,
             // runs registered middleware like VTEX cookie forwarding).
+            // Publish the segment token so the SSR can hand it to the browser
+            // (see sdk/cdnSegment). Only the server can compute this: region
+            // comes from `request.cf`, which the client never sees. Per-request
+            // via the RequestContext bag — a module-level global here would be
+            // the layout-cache race all over again.
+            if (buildSegment && cdnCacheControlOpt === "serverfn-segment") {
+              const token = segmentToken(
+                requestSegmentDescriptor(request),
+                buildSegment(request).loggedIn === true,
+                getBuildHash(env),
+              );
+              if (token) RequestContext.setBag(CSEG_BAG_KEY, token);
+            }
+
             const appMw = getAppMiddleware();
             const innerResponse = appMw
               ? await appMw(request, () => handleRequest(request, env, ctx))
