Ok, found the problem. It only works with the privilege guests / View Users enabled. I had fediverse / View Users enabled anyway but that wasn't enough.
I'm not sure if that's intended? I guess it makes sense in principle…
I received an activity with this ID:https://community.nodebb.org/post/100125#activity/create/1719328808532#activity/announce/1719328833687It has two #-signs. I think it is not a valid URI: https://datatracker.ietf.org/doc/html/rfc3986#section-3.5A fragment identifier component is indicated by the presence of a number sign ("#") character and terminated by the end of the URI.