diff --git a/htdocs/public.php b/htdocs/public.php
index cc12f8ee..b79e32b0 100644
--- a/htdocs/public.php
+++ b/htdocs/public.php
@@ -19,6 +19,18 @@ $dav = "1, 2, calendar-access";
 header( "DAV: $dav");
 require_once("CalDAVRequest.php");
 $request = new CalDAVRequest();
+
+// A CalDAV client performing calendar discovery may send an OPTIONS request to
+// an ancestor of the ticketed collection (e.g. OPTIONS /user/?ticket=...) to
+// probe server capabilities. OPTIONS returns only capability headers, never
+// resource data, so answer it whenever a valid ticket is presented, even when
+// the ticket scope does not cover that ancestor. Data-bearing methods below
+// stay gated by the ticket path check, so no collection contents are exposed.
+if ( $request->method == 'OPTIONS'
+     && isset($request->ticket) && ! $request->ticket->expired ) {
+  header('Allow: OPTIONS, GET, HEAD, PROPFIND, REPORT');
+  $request->DoResponse( 200, '' );
+}
 if ( ! $request->IsPublic() &&
            (! isset($request->ticket)
            || $request->ticket->expired