diff --git a/lib/package-server.js b/lib/package-server.js
index 60c534d..19d2bda 100644
--- a/lib/package-server.js
+++ b/lib/package-server.js
@@ -89,13 +89,19 @@ function loadPages(pkgConf, packagedPage, req, res, next) {
   if (!packagedPage._promise_page) {
     packagedPage._promise_page = new PromiseA(function (resolve, reject) {
       fs.exists(pkgpath, function (exists) {
+        var staticServer;
+
         if (!exists) {
           reject(new Error("package '" + pkgpath + "' is registered but does not exist"));
           return;
         }
 
         //console.log('[static mount]', pkgpath);
-        resolve(require('serve-static')(pkgpath));
+        // https://github.com/expressjs/serve-static/issues/54
+        // https://github.com/pillarjs/send/issues/91
+        // https://example.com/.well-known/acme-challenge/xxxxxxxxxxxxxxx
+        staticServer = require('serve-static')(pkgpath, { dotfiles: undefined });
+        resolve(staticServer);
       });
     });
   }
@@ -411,10 +417,27 @@ function mapToApp(opts, req, res, next) {
     return;
   }
 
+  // TODO .well-known can be an API (webfinger, letsencrypt, oauth3)
+  // or static (...???)
+
   if (!router._re_api.test(req.url)) {
     //console.log('[static router]');
     //console.log(router._re_api, req.url);
-    layerItUp(pkgConf, router, req, res, next);
+    layerItUp(pkgConf, router, req, res, function (err) {
+      if (err) {
+        next(err);
+        return;
+      }
+
+      if (/\/\.well-known([\/?]|$)/.test(req.url)) {
+        console.log('[TODO] handle .well-known as API');
+        // rewrite api as /api/org.ietf/.well-known ?
+        // pass through simply as /.well-known ?
+        // runApi(opts, router, req, res, next)
+      }
+
+      next();
+    });
     return;
   }