diff --git a/crates/buzz-pubsub/src/cache_invalidation.rs b/crates/buzz-pubsub/src/cache_invalidation.rs
index d5df74ddf0..c94eabfbe4 100644
--- a/crates/buzz-pubsub/src/cache_invalidation.rs
+++ b/crates/buzz-pubsub/src/cache_invalidation.rs
@@ -78,7 +78,7 @@ pub enum CacheInvalidation {
     ChannelDeleted,
     /// Drop one pubkey's relay-membership entry. Mirrors
     /// `invalidate_relay_membership` (invite claim, admin add/remove,
-    /// self-leave).
+    /// self-leave, ownership transfer).
     RelayMembership {
         /// Affected member's pubkey bytes.
         pubkey: Vec<u8>,
diff --git a/crates/buzz-relay/src/api/mod.rs b/crates/buzz-relay/src/api/mod.rs
index baecf2fdb8..cd64cf20cb 100644
--- a/crates/buzz-relay/src/api/mod.rs
+++ b/crates/buzz-relay/src/api/mod.rs
@@ -68,7 +68,6 @@ pub mod relay_members {
             return Ok(MembershipDecision::OpenRelay);
         }
 
-        let pubkey_hex = hex::encode(pubkey_bytes);
         let is_member = state
             .is_relay_member_cached(community, pubkey_bytes)
             .await
@@ -79,6 +78,7 @@ pub mod relay_members {
 
         if state.config.allow_nip_oa_auth {
             if let Some(tag_json) = auth_tag_header {
+                let pubkey_hex = hex::encode(pubkey_bytes);
                 let agent_pubkey = nostr::PublicKey::from_slice(pubkey_bytes)
                     .map_err(|e| format!("invalid agent pubkey for NIP-OA check: {e}"))?;
 
diff --git a/crates/buzz-relay/src/state.rs b/crates/buzz-relay/src/state.rs
index c6f6bbba2d..b8a846b542 100644
--- a/crates/buzz-relay/src/state.rs
+++ b/crates/buzz-relay/src/state.rs
@@ -546,7 +546,7 @@ pub struct AppState {
     /// Relay membership cache: (community_id, pubkey_bytes) → is_relay_member.
     /// Short TTL (10s) — checked on every authenticated HTTP request and WS
     /// AUTH, so this keeps the hot auth path off the writer pool. Invalidated
-    /// on invite claim, admin add/remove, and self-leave.
+    /// on invite claim, admin add/remove, self-leave, and ownership transfer.
     pub relay_membership_cache: Arc<moka::sync::Cache<(CommunityId, Vec<u8>), bool>>,
     /// Accessible channel IDs cache: (community_id, pubkey_bytes) → channel UUIDs.
     /// Short TTL (10s) — invalidated on membership or channel visibility changes.