It works — served via CloudFront + S3 with OAC.