diff --git a/crates/metadata/src/lib.rs b/crates/metadata/src/lib.rs
index 0769580..e5d9c10 100644
--- a/crates/metadata/src/lib.rs
+++ b/crates/metadata/src/lib.rs
@@ -1857,12 +1857,24 @@ impl MetadataClient {
             // together, but consume it in the original wave order so candidate
             // membership, metadata upgrades, ranks and early-stop behavior stay
             // identical to the sequential implementation.
+            // `safesearch=strict` is load-bearing for RELEVANCE, not just for
+            // decency. Our client keeps no cookie jar, so every read reaches
+            // Bing with its adult-content preference undefined -- and in that
+            // state Bing answers with wholly unrelated cached result sets: four
+            // identical back-to-back reads for "Fishmans band photo" returned
+            // porn, an Indonesian chord page, porn again, and a printable 2026
+            // calendar, each internally coherent with honest titles and purls.
+            // Measured 27/27 reads with zero relevant cards without the flag
+            // and 27/27 correct with it. Only `strict` fixes it; `moderate` and
+            // `off` behave exactly like sending nothing at all. This was
+            // misdiagnosed twice (as a poisoned IP, then as Bing rate-limiting)
+            // because the failure looks external and clears on its own.
             let wave_urls = waves
                 .iter()
                 .take(wave_limit)
                 .map(|wave| {
                     format!(
-                        "https://www.bing.com/images/search?q={q}&qft={}&form=HDRSC3&first=1&cc=us&setlang=en-us&tsc=ImageHoverTitle",
+                        "https://www.bing.com/images/search?q={q}&qft={}&form=HDRSC3&first=1&cc=us&setlang=en-us&tsc=ImageHoverTitle&safesearch=strict",
                         urlencode(wave)
                     )
                 })