diff --git a/openflare_agent/internal/nginx/waf_assets.go b/openflare_agent/internal/nginx/waf_assets.go
index 86dfc318..e43306d7 100644
--- a/openflare_agent/internal/nginx/waf_assets.go
+++ b/openflare_agent/internal/nginx/waf_assets.go
@@ -158,6 +158,7 @@ local function active_groups(config, groups)
 end
 
 local function exit_with_group(group)
+    ngx.ctx.openflare_waf_blocked = true
     ngx.status = tonumber(group.block_status_code) or 418
     local body = group.block_response_body or ""
     if body ~= "" then
diff --git a/openflare_server/service/config_version.go b/openflare_server/service/config_version.go
index c70cca45..c1ebf91f 100644
--- a/openflare_server/service/config_version.go
+++ b/openflare_server/service/config_version.go
@@ -1265,6 +1265,9 @@ func renderAccessBlock(siteName string, powEnabled bool) string {
 	return fmt.Sprintf(`    set $openflare_waf_site "%s";
     access_by_lua_block {
         dofile("%s/waf/check.lua")
+        if ngx.ctx.openflare_waf_blocked then
+            return
+        end
         dofile("%s/pow/check.lua")
     }
 `, escapedSiteName, nginxLuaDirPlaceholder, nginxLuaDirPlaceholder)
diff --git a/openflare_server/service/https_phase1_test.go b/openflare_server/service/https_phase1_test.go
index f66b4729..7de98a9b 100644
--- a/openflare_server/service/https_phase1_test.go
+++ b/openflare_server/service/https_phase1_test.go
@@ -1025,8 +1025,8 @@ func TestPublishConfigVersionDetectsPoWChanges(t *testing.T) {
 	if !strings.Contains(secondRelease.Version.RenderedConfig, "application/javascript js mjs;") {
 		t.Fatal("expected rendered config to serve Anubis module scripts with a JavaScript MIME type")
 	}
-	if !strings.Contains(secondRelease.Version.RenderedConfig, "        dofile(\"__OPENFLARE_LUA_DIR__/waf/check.lua\")\n        dofile(\"__OPENFLARE_LUA_DIR__/pow/check.lua\")") {
-		t.Fatal("expected combined WAF and PoW access handler to render at server scope")
+	if !strings.Contains(secondRelease.Version.RenderedConfig, "        dofile(\"__OPENFLARE_LUA_DIR__/waf/check.lua\")\n        if ngx.ctx.openflare_waf_blocked then\n            return\n        end\n        dofile(\"__OPENFLARE_LUA_DIR__/pow/check.lua\")") {
+		t.Fatal("expected combined WAF and PoW access handler to short-circuit before PoW")
 	}
 	locationStart := strings.Index(secondRelease.Version.RenderedConfig, "    location / {\n")
 	if locationStart < 0 {