diff --git a/CHANGELOG.md b/CHANGELOG.md
index f799af51..c94ffc1a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@ If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If
   - Expand lists and resolve catch-all addresses when building autogenerated messages.
 - Sharing: Includes resource that themselves carry a direct ACL grant and are leaves.
 - Tasks cannot be deleted in OSS builds.
+- Directory: Per-domain external directory resolution fails.
 
 ## [0.16.6] - 2026-05-20
 
diff --git a/crates/common/src/auth/authentication.rs b/crates/common/src/auth/authentication.rs
index 03b01bf9..f87cd2d1 100644
--- a/crates/common/src/auth/authentication.rs
+++ b/crates/common/src/auth/authentication.rs
@@ -516,7 +516,8 @@ impl Server {
                 .domain(domain_name)
                 .await
                 .caused_by(trc::location!())?
-                .and_then(|domain| self.core.storage.directories.get(&domain.id))
+                .and_then(|domain| domain.id_directory)
+                .and_then(|id_directory| self.core.storage.directories.get(&id_directory))
                 .or_else(|| self.get_default_directory()));
         }
         // SPDX-SnippetEnd