diff --git a/cdn.tf b/cdn.tf
index ffe9b21..349486e 100644
--- a/cdn.tf
+++ b/cdn.tf
@@ -52,6 +52,26 @@
 
 ### cran.rpkgs.com
 
+locals {
+  rpkgs_slots = [
+    for pair in setproduct(
+      ["amd64", "arm64"],
+      ["resolute", "noble", "jammy", "rhel8", "rhel9", "rhel10", "alpine323", "alpine324"]
+    ) : "${pair[0]}/${pair[1]}"
+  ]
+
+  # The supported R minors: the current one plus the two previous, which is
+  # exactly what build-env-images installs as R_VERSION_LATEST / PREV1 / PREV2.
+  # These must stay in step. A minor listed here without a published index
+  # sends those clients to a 404; a published minor missing from this list
+  # sends them to CRAN for sources instead of serving the binaries we built.
+  rpkgs_supported_minors = ["4.4", "4.5", "4.6"]
+
+  # bunny.net serves every pull zone on <name>.b-cdn.net, so staging needs no
+  # DNS record and is never advertised.
+  rpkgs_test_hostname = "cran-rpkgs-test.b-cdn.net"
+}
+
 # The edge middleware that resolves the bare cran.rpkgs.com form to an
 # <arch>/<os> slot and routes PACKAGES* to the per-R-minor slot. The source of
 # truth is edge/rpkgs-router.ts; `tofu apply` publishes a new release.
@@ -75,6 +95,13 @@ resource "bunnynet_compute_script_variable" "rpkgs_router_union_slots" {
   required      = false
 }
 
+resource "bunnynet_compute_script_variable" "rpkgs_router_known_minors" {
+  script        = bunnynet_compute_script.rpkgs_router.id
+  name          = "KNOWN_MINORS"
+  default_value = join(",", local.rpkgs_supported_minors)
+  required      = false
+}
+
 resource "bunnynet_pullzone" "cran_rpkgs_com" {
   name = "cran-rpkgs"
 
@@ -152,18 +179,6 @@ resource "bunnynet_pullzone_hostname" "cran_rpkgs_com" {
 # Every published <arch>/<os> slot. The staging zone enables per-minor routing
 # for all of them at once; production adopts the same list only after
 # `scripts/verify-r-minor-routing.sh --live` passes against staging.
-locals {
-  rpkgs_slots = [
-    for pair in setproduct(
-      ["amd64", "arm64"],
-      ["resolute", "noble", "jammy", "rhel8", "rhel9", "rhel10", "alpine323", "alpine324"]
-    ) : "${pair[0]}/${pair[1]}"
-  ]
-
-  # bunny.net serves every pull zone on <name>.b-cdn.net, so staging needs no
-  # DNS record and is never advertised.
-  rpkgs_test_hostname = "cran-rpkgs-test.b-cdn.net"
-}
 
 # A second copy of the same router, bound to the same B2 origin, so UNION_SLOTS
 # can be exercised end to end before production is touched.
@@ -189,6 +204,13 @@ resource "bunnynet_compute_script_variable" "rpkgs_router_test_extra_hosts" {
   required      = false
 }
 
+resource "bunnynet_compute_script_variable" "rpkgs_router_test_known_minors" {
+  script        = bunnynet_compute_script.rpkgs_router_test.id
+  name          = "KNOWN_MINORS"
+  default_value = join(",", local.rpkgs_supported_minors)
+  required      = false
+}
+
 resource "bunnynet_pullzone" "cran_rpkgs_test" {
   name = "cran-rpkgs-test"
 
diff --git a/edge/rpkgs-router.test.ts b/edge/rpkgs-router.test.ts
index 4bfaa28..3e2fe8b 100644
--- a/edge/rpkgs-router.test.ts
+++ b/edge/rpkgs-router.test.ts
@@ -98,17 +98,29 @@ Deno.test('rpkgs-router', async (t) => {
       assertEquals(res.location, `https://cran.rpkgs.com${SLOT}/4.6/PACKAGES.gz`);
     });
 
-    // No per-minor index is published for 4.3, and contribPath() cannot probe
-    // the origin. Routing it would send the client to a 404 and it would see no
-    // packages at all, so an unpublished minor must fall through to flat.
-    await t.step('falls back to flat for an R minor that is not published', async () => {
+    // We publish binaries only for the supported window. An excluded minor has
+    // no slot we can serve safely, so it goes to CRAN for sources rather than
+    // to a 404 or to binaries built under another minor.
+    await t.step('sends an excluded R minor to CRAN for the index', async () => {
       const res = await probe(`${SLOT}/PACKAGES.gz`, UA_R43_MUSL);
-      assertEquals(res.location, null);
-      assertEquals(res.status, 200);
+      assertEquals(res.location, 'https://cran.r-project.org/src/contrib/PACKAGES.gz');
     });
 
-    await t.step('falls back to flat for a future R minor', async () => {
+    await t.step('sends a future R minor to CRAN too', async () => {
       const res = await probe(`${SLOT}/PACKAGES.gz`, UA_R47_MUSL);
+      assertEquals(res.location, 'https://cran.r-project.org/src/contrib/PACKAGES.gz');
+    });
+
+    // The index and the tarballs R resolves against it have to come from the
+    // same place. Serving one from CRAN and the other from here would hand R a
+    // binary where it expects a source tarball.
+    await t.step('sends an excluded minor to CRAN for tarballs as well', async () => {
+      const res = await probe(`${SLOT}/foo_1.0.tar.gz`, UA_R43_MUSL);
+      assertEquals(res.location, 'https://cran.r-project.org/src/contrib/foo_1.0.tar.gz');
+    });
+
+    await t.step('leaves an excluded minor alone on a slot outside UNION_SLOTS', async () => {
+      const res = await probe(`${OTHER_SLOT}/PACKAGES.gz`, UA_R43_MUSL);
       assertEquals(res.location, null);
       assertEquals(res.status, 200);
     });
diff --git a/edge/rpkgs-router.ts b/edge/rpkgs-router.ts
index e9aec22..05b6e18 100644
--- a/edge/rpkgs-router.ts
+++ b/edge/rpkgs-router.ts
@@ -121,6 +121,18 @@ function publicCdnOrigin(url: URL): string {
   return PUBLIC_CDN_HOSTS.has(url.hostname) ? url.origin : PUBLIC_CDN_ORIGIN;
 }
 
+/**
+ * True when the client reports an R minor that we deliberately do not serve.
+ *
+ * A client that reports no minor at all is not "unsupported": non-R fetchers
+ * (mirror scripts, image builds) must keep getting the flat slot. Only a
+ * known-and-excluded minor falls through to CRAN.
+ */
+function isExcludedMinor(userAgent: string): boolean {
+  const rMinor = extractRMinor(userAgent);
+  return rMinor !== null && !KNOWN_MINORS.has(rMinor);
+}
+
 function extractRMinor(userAgent: string): string | null {
   for (const regex of R_MINOR_REGEXES) {
     const match = userAgent.match(regex);
@@ -249,6 +261,16 @@ BunnySDK.net.http
         return Promise.resolve(ctx.request);
       }
 
+      // An R minor outside the supported window has no binaries we can safely
+      // serve, so the whole interaction goes to CRAN: the index and the
+      // tarballs R will resolve against it. Serving the index from CRAN but
+      // tarballs from here would hand R a binary where it expects a source
+      // tarball, which fails in a far more confusing way than not being
+      // served at all.
+      if (UNION_SLOTS.has(slot) && isExcludedMinor(userAgent)) {
+        return Promise.resolve(redirectTo(`${CRAN_ORIGIN}/src/contrib/${rest}`));
+      }
+
       const target = contribPath(slot, rest, userAgent);
       if (target === path) {
         return Promise.resolve(ctx.request);
@@ -263,6 +285,10 @@ BunnySDK.net.http
         return Promise.resolve(redirectTo(`${CRAN_ORIGIN}${path}`));
       }
 
+      if (UNION_SLOTS.has(slot) && isExcludedMinor(userAgent)) {
+        return Promise.resolve(redirectTo(`${CRAN_ORIGIN}${path}`));
+      }
+
       const rest = srcContrib ? srcContrib[1] : '';
       return Promise.resolve(redirectTo(`${publicOrigin}${contribPath(slot, rest, userAgent)}`));
     }
diff --git a/scripts/verify-r-minor-routing.sh b/scripts/verify-r-minor-routing.sh
index 0096b0e..28acd92 100755
--- a/scripts/verify-r-minor-routing.sh
+++ b/scripts/verify-r-minor-routing.sh
@@ -33,9 +33,14 @@ set -uo pipefail
 BASE=${BASE:-https://cran.rpkgs.com}
 ARCHES=${ARCHES:-"amd64 arm64"}
 DISTROS=${DISTROS:-"resolute noble jammy rhel8 rhel9 rhel10 alpine323 alpine324"}
-# Minors a client may plausibly report. 4.3 is listed because the published
-# support notes still claim it.
-MINORS=${MINORS:-"4.3 4.4 4.5 4.6"}
+# The supported window: the current R minor plus the two previous, matching
+# build-env-images' R_VERSION_LATEST/PREV1/PREV2 and cdn.tf's
+# local.rpkgs_supported_minors. Each of these must have a published index.
+MINORS=${MINORS:-"4.4 4.5 4.6"}
+# Minors we deliberately do not serve. These must have NO published index and,
+# once routing is live, must be sent to CRAN for sources rather than 404ing or
+# being handed binaries built under another minor.
+EXCLUDED_MINORS=${EXCLUDED_MINORS:-"4.3"}
 # How many Path: targets to HEAD-check per slot/minor. 0 disables.
 SAMPLE=${SAMPLE:-5}
 # Largest package-count shortfall a non-primary minor may have against the best
@@ -121,7 +126,7 @@ r_user_agent() {
 
 echo "verify-r-minor-routing: $BASE"
 echo "  slots:  $(echo "$ARCHES" | wc -w) arch x $(echo "$DISTROS" | wc -w) os"
-echo "  minors: $MINORS"
+echo "  minors: $MINORS  (excluded: $EXCLUDED_MINORS)"
 echo "  live:   $LIVE"
 echo
 
@@ -238,6 +243,33 @@ for arch in $ARCHES; do
       fi
     fi
 
+    # Excluded minors: no published index, and under --live a redirect to CRAN.
+    for minor in $EXCLUDED_MINORS; do
+      ex_url="$BASE/$slot/latest/src/contrib/$minor/PACKAGES.gz"
+      ex_status=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 60 "$ex_url" 2>/dev/null)
+      if [ "$ex_status" = "200" ]; then
+        bad "$slot R $minor is excluded but an index is published - the two lists disagree"
+      else
+        ok "$slot R $minor correctly has no published index"
+      fi
+
+      if [ "$LIVE" -eq 1 ]; then
+        loc=$(curl -sS -o /dev/null -w '%{redirect_url}' -A "$(r_user_agent "$minor")" \
+          --max-time 60 "$flat_url" 2>/dev/null)
+        case "$loc" in
+          https://cran.r-project.org/*)
+            ok "$slot R $minor is sent to CRAN ($loc)"
+            ;;
+          "")
+            bad "$slot R $minor was served directly instead of being sent to CRAN"
+            ;;
+          *)
+            bad "$slot R $minor redirected somewhere unexpected: $loc"
+            ;;
+        esac
+      fi
+    done
+
     # A client whose User-Agent carries no R version must keep getting the flat
     # index, never a per-minor one.
     if [ "$LIVE" -eq 1 ]; then