diff --git a/protocol.py b/protocol.py
index 4a87d52..34f3043 100644
--- a/protocol.py
+++ b/protocol.py
@@ -179,6 +179,10 @@ class Protocol:
             user_id = user
             user = from_cls.get_by_id(user_id, allow_opt_out=True)
 
+        if from_label == 'web':
+            if bot_protocol := Protocol.for_bridgy_subdomain(user_id):
+                return to_cls != bot_protocol
+
         if user:
             if user.status == 'opt-out':
                 return False
diff --git a/tests/test_protocol.py b/tests/test_protocol.py
index ed8fe4d..1f05e32 100644
--- a/tests/test_protocol.py
+++ b/tests/test_protocol.py
@@ -210,6 +210,18 @@ class ProtocolTest(TestCase):
         user.put()
         self.assertTrue(ExplicitEnableFake.is_enabled_to(Fake, 'eefake:foo'))
 
+    def test_is_enabled_to_protocol_bot_users(self):
+        # protocol bot users should always be enabled to *other* protocols
+        self.assertTrue(Web.is_enabled_to(Fake, 'eefake.brid.gy'))
+        self.assertTrue(Web.is_enabled_to(ExplicitEnableFake, 'fa.brid.gy'))
+        self.assertTrue(Web.is_enabled_to(Fake, 'other.brid.gy'))
+        self.assertTrue(Web.is_enabled_to(ATProto, 'ap.brid.gy'))
+        self.assertTrue(Web.is_enabled_to(ActivityPub, 'bsky.brid.gy'))
+
+        # ...but not to their own protocol
+        self.assertFalse(Web.is_enabled_to(ActivityPub, 'ap.brid.gy'))
+        self.assertFalse(Web.is_enabled_to(ATProto, 'bsky.brid.gy'))
+
     def test_load(self):
         Fake.fetchable['foo'] = {'x': 'y'}