diff --git a/src/ria_toolkit_oss/agent/cli.py b/src/ria_toolkit_oss/agent/cli.py
index 0b06e72..41be210 100644
--- a/src/ria_toolkit_oss/agent/cli.py
+++ b/src/ria_toolkit_oss/agent/cli.py
@@ -43,12 +43,16 @@ def _cmd_register(args: argparse.Namespace) -> int:
     hub_url = args.hub.rstrip("/")
     url = f"{hub_url}/screens/agents/register"
     body = json.dumps({"name": args.name or ""}).encode()
+    # Explicit User-Agent: Python's default `Python-urllib/<ver>` is blocked
+    # by Cloudflare's Browser Integrity Check on `riahub.ai` (HTTP 403 code
+    # 1010), so register() never reached the hub. Any non-default UA passes.
     req = urllib.request.Request(
         url,
         data=body,
         headers={
             "Content-Type": "application/json",
             "X-API-Key": args.api_key,
+            "User-Agent": "ria-agent/0.1 (+https://github.com/RIA-Toolkit/ria-toolkit-oss)",
         },
     )
     try: