Overwriting ASP.NET errors with IIS httpErrors, except for web services

I am looking at <httpErrors> and I can't figure out what existingResponse mode is correct for my goals.

I want to ensure all ASP.NET error pages are completely hidden from the client, so it is not possible to identify the site as ASP.NET. This means that PassThrough is not the right choice.

However I still want to preserve the error body when it's not aimed at users, e.g. in web service responses, so Replace isn't right either.

This leaves Auto, but the problem I face is that ASP.NET internally sets TrySkipIisCustomErrors = true if an error occurs (see HttpResponse.cs:1297) This includes any errors in handler for customErrors, which, as result, leak ASP.NET error pages -- no stack trace, but not a custom page either.

Is there a bulletproof solution that would replace all ASP.NET error responses with IIS responses by default, while still leaving space for manual override in certain cases? And by manual I mean "in my code only".