diff --git a/Lescript.php b/Lescript.php
index b81d01f..deb1f18 100644
--- a/Lescript.php
+++ b/Lescript.php
@@ -159,9 +159,14 @@ function ($domain) {
 
             $result = null;
             while ($loopCount < $maxAllowedLoops) {
+                // Only the first request may carry the trigger payload: the
+                // server accepts it while the authorization is "pending" and
+                // rejects it with 400 "Unable to update challenge ::
+                // authorization must be pending" as soon as validation has
+                // completed. Poll with POST-as-GET afterwards (RFC 8555 7.5.1).
                 $result = $this->signedRequest(
                     $challenge['url'],
-                    array("keyAuthorization" => $payload)
+                    $loopCount === 1 ? array("keyAuthorization" => $payload) : null
                 );
 
                 if (empty($result['status']) || $result['status'] == "invalid") {