diff --git a/templates/home.html.j2 b/templates/home.html.j2
index b42018e..68d73cb 100644
--- a/templates/home.html.j2
+++ b/templates/home.html.j2
@@ -62,9 +62,12 @@
           {% endif %}
         </div>
         <div class="hero-actions">
+          {# app.js hides the locate button outside a secure context, where the
+             browser refuses geolocation and it could only ever fail. #}
           <button type="button" id="hero-locate" class="btn-primary">Use my location</button>
           <button type="button" id="hero-pick" class="btn-ghost">Pick on the map</button>
         </div>
+        <p class="hero-locate-msg" id="hero-locate-msg" role="status" aria-live="polite" hidden></p>
         <p class="hero-jump"><a href="#panel">See your week ↓</a></p>
       </div>
     </section>
diff --git a/tests/test_homepage.py b/tests/test_homepage.py
index 30e07ff..ec60713 100644
--- a/tests/test_homepage.py
+++ b/tests/test_homepage.py
@@ -124,6 +124,16 @@ def test_homepage_is_complete_without_js(client, no_feed):
     assert 'p class="site-name"' in html
 
 
+def test_hero_locate_has_a_status_slot(client, no_feed):
+    """The locate button needs somewhere to report a declined prompt or a
+    timeout. Without it the control fails silently, which is how it shipped
+    broken: navigator.geolocation exists on plain http:// but always errors."""
+    html = client.get(f"{B}/").text
+    assert 'id="hero-locate"' in html
+    assert 'id="hero-locate-msg"' in html
+    assert 'aria-live="polite"' in html
+
+
 def test_city_chips_all_resolve(client, no_feed):
     """Every homepage chip must be a real, routable city — a stale slug would
     render an empty chip list and leak a 404 link."""