After a password login the offer page (oauth2WebAuthnReauthEnable) is shown, so the page honours the application override.
Clicking Register sends POST /oauth2/ajax/webauthn/start-registration, which returns 403 with an empty body. No Event Log entry.
Turning the re-authentication workflow on at tenant level makes Register work, with no other change.

So the endpoint seems to read only the tenant setting. Our workaround is to turn the workflow on at tenant level and add an override with both workflows off to every other application. Can you confirm this is a bug and whether a fix is planned, so we can remove the per-application overrides later?