diff --git a/inline-script.js b/inline-script.js
index dffe370..f9a6a4d 100644
--- a/inline-script.js
+++ b/inline-script.js
@@ -34,3 +34,9 @@ if (!localStorage.store_currentInstance) {
   style.textContent = '.hidden-from-ssr { opacity: 1 !important; }'
   document.head.appendChild(style)
 }
+
+// TODO: remove this hack when Safari works with cross-origin window.open()
+// in a PWA: https://github.com/nolanlawson/pinafore/issues/45
+if (/iP(?:hone|ad|od)/.test(navigator.userAgent)) {
+  document.head.removeChild(document.getElementById('theManifest'))
+}
diff --git a/server.js b/server.js
index 7dd8c6c..e072ce1 100644
--- a/server.js
+++ b/server.js
@@ -48,17 +48,6 @@ app.use(nonDebugOnly(helmet({
   }
 })))
 
-// TODO: remove this hack when Safari works with cross-origin window.open()
-// in a PWA: https://github.com/nolanlawson/pinafore/issues/45
-app.get('/manifest.json', (req, res, next) => {
-  if (/iP(?:hone|ad|od)/.test(req.headers['user-agent'])) {
-    return res.status(404).send({
-      error: 'manifest.json is disabled for iOS. see https://github.com/nolanlawson/pinafore/issues/45'
-    })
-  }
-  return next()
-})
-
 app.use(serveStatic('assets', {
   setHeaders: (res) => {
     res.setHeader('Cache-Control', 'public,max-age=600')
diff --git a/templates/2xx.html b/templates/2xx.html
index 0db83b2..1c7acae 100644
--- a/templates/2xx.html
+++ b/templates/2xx.html
@@ -6,7 +6,7 @@
   <meta id='theThemeColor' name='theme-color' content='#4169e1' >
   <meta name="description" content="An alternative web client for Mastodon, focused on speed and simplicity." >
 
-  <link rel='manifest' href='/manifest.json' >
+  <link id='theManifest' rel='manifest' href='/manifest.json' >
   <link id='theFavicon' rel='icon' type='image/png' href='/favicon.png' >
   <link rel="apple-touch-icon" sizes="120x120" href="/apple-icon-120.png" >
   <link rel="apple-touch-icon" sizes="180x180" href="/apple-icon-180.png" >
@@ -77,6 +77,12 @@ if (!localStorage.store_currentInstance) {
   style.textContent = '.hidden-from-ssr { opacity: 1 !important; }'
   document.head.appendChild(style)
 }
+
+// TODO: remove this hack when Safari works with cross-origin window.open()
+// in a PWA: https://github.com/nolanlawson/pinafore/issues/45
+if (/iP(?:hone|ad|od)/.test(navigator.userAgent)) {
+  document.head.removeChild(document.getElementById('theManifest'))
+}
 })()</script><!-- end insert inline script here -->
   <svg xmlns="http://www.w3.org/2000/svg" style="display:none;">
     <!-- auto-generated w/ build-svg.js -->