diff --git a/UPGRADING.md b/UPGRADING.md
index 19469820..ebabbccb 100644
--- a/UPGRADING.md
+++ b/UPGRADING.md
@@ -97,6 +97,73 @@ example letters and digits:
 req.BindingMessage = "W4SCT"
 ```
 
+### `X5CAttesterChain` limits the RSA keys of `x5c` certificates (server)
+
+**Affects:** a server whose `Dependencies.AttesterTrust` is
+`server.X5CAttesterChain`, when a wallet's attestation `x5c` carries a
+certificate — the signing certificate or an intermediate — whose
+public key is RSA with a modulus over 4096 bits or a public exponent
+other than 65537. Anchors you configure (`TrustAnchors`, `Anchors`)
+aren't limited.
+
+**Why:** the `x5c` certificates are the caller's, and `crypto/x509`
+bounds neither an RSA modulus nor its exponent. Path building spent an
+RSA operation on whatever key an unauthenticated request carried, so a
+31,744-bit modulus with exponent 2^31-1 cost the server about 60 ms of
+CPU per request. v0.63.0 already limited every other RSA key a caller
+supplies (a DPoP `jwk`, an attestation's `cnf.jwk`, a client's JWK Set)
+to 4096 bits and exponent 65537; `x5c` now follows the same rule,
+checked before any signature.
+
+**What fails:** nothing at startup. Such an attestation is refused
+with `invalid_client`. There is no option to keep the old behaviour.
+
+**What to change:** have the attester's CA issue its signing and
+intermediate certificates for 2048-, 3072- or 4096-bit RSA keys with
+exponent 65537, or for EC keys:
+
+```sh
+openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 -out attester-ca.pem
+```
+
+### `IssueAccessToken` and `IssueRefreshToken` refuse an edited binding or attestation expiry (server)
+
+**Affects:** an embedder serving its own grant
+(`Config.AdditionalGrantTypes`) that changes, after the server returned
+them, the `Thumbprint` of a `server.TokenBinding` from
+`VerifyTokenRequestBinding` before passing it to `IssueAccessToken`, or
+the `AttestationExpiresAt` of a `server.AttestedClient` from
+`AuthenticateAttestedClient` before passing it to `IssueAccessToken` or
+`IssueRefreshToken`.
+
+**Why:** both documented that only what the server verified is
+accepted, but the check covered only the client the value was verified
+for. An edited `Thumbprint` bound the access token to a key that never
+proved possession, and an extended `AttestationExpiresAt` let a
+`Client` kept from an earlier request pass the attestation expiry
+check. Each now keeps its own copy of what was verified.
+
+**What fails:** nothing at startup. Such a call is refused with a
+`server_error` `*server.Error`.
+
+**What to change:** pass both exactly as the server returned them, for
+the current request:
+
+```go
+attested, err := srv.AuthenticateAttestedClient(ctx, req.AttestedClientAuthentication())
+if err != nil {
+	return err
+}
+binding, err := srv.VerifyTokenRequestBinding(ctx, attested.Client, req)
+if err != nil {
+	return err
+}
+result, err := srv.IssueAccessToken(ctx, server.IssueAccessTokenRequest{
+	GrantType: grantType, Client: attested, Binding: binding,
+	Subject: subject, Scope: scope,
+})
+```
+
 ## v0.68.0
 
 ### `DefaultAttesterLeafPolicy` refuses more signing roles (server)
@@ -171,6 +238,12 @@ anchor, including cross-signed copies:
 x5c := [][]byte{leaf.Raw, intermediate.Raw}
 ```
 
+*Relaxed in v0.69.0:* a configured anchor in `x5c` that isn't
+self-signed is accepted when a verified chain also ends at an anchor
+`x5c` doesn't carry, as `[leaf, intermediate]` does with both the root
+and the intermediate configured as anchors. It's refused only when
+every verified chain ends at an anchor the wallet sent.
+
 ## v0.66.0
 
 ### `X5CAttesterChain` refuses other roles' signing certificates (server)
@@ -274,6 +347,12 @@ anchor:
 x5c := [][]byte{leaf.Raw, intermediate.Raw}
 ```
 
+*Relaxed in v0.69.0:* a configured anchor in `x5c` that isn't
+self-signed is accepted when a verified chain also ends at an anchor
+`x5c` doesn't carry, as `[leaf, intermediate]` does with both the root
+and the intermediate configured as anchors. It's refused only when
+every verified chain ends at an anchor the wallet sent.
+
 ## v0.65.0
 
 ### `Limits.MaxAccessTokenClaimsBytes` is required (server)
diff --git a/docs/guides/native-wallet.md b/docs/guides/native-wallet.md
index d914b199..9df5ece6 100644
--- a/docs/guides/native-wallet.md
+++ b/docs/guides/native-wallet.md
@@ -36,17 +36,27 @@ A native client may use a private-use scheme in reverse-domain form,
 written with a single slash (`com.example.wallet:/callback`), loopback
 `http` to `127.0.0.1` or `[::1]` (never `localhost`, RFC 8252 §8.3),
 matched on any port, or a claimed `https` URI, in production as well;
-`NewRegisteredClient` refuses any other form. The server also
+`NewRegisteredClient` refuses any other form. The attestation is the
+client's authentication method, not an extra signal beside another
+one: the server doesn't support the attestation-based client
+authentication draft's use alongside `private_key_jwt` (draft-12
+§7.6), and refuses a request carrying both an attestation and a
+`client_assertion` with `invalid_request`. The server also
 needs `Config.AttestationBasedClientAuthentication` and an
 `AttesterTrust`: `server.RegisteredAttesterKeys` with the attesters'
 own keys, by issuer (a `keys.AttesterKeySource` such as
 `keys.StaticAttesterKeys` — never the clients' keys), or
-`server.X5CAttesterChain` to verify the attestation's `x5c` chain. That
-`x5c` carries the signing certificate and its intermediates only, as
-HAIP 1.0 requires: an attestation whose `x5c` also includes a trust
-anchor (any self-signed certificate, or a certificate with a
-configured anchor's subject and public key, such as a cross-signed
-copy of it) is `invalid_client`. With
+`server.X5CAttesterChain` to verify the attestation's `x5c` chain.
+HAIP 1.0 §4.4.1 has the wallet send the signing certificate and its
+intermediates only, leaving out the trust anchor. The server refuses
+an `x5c` that includes any self-signed certificate, or whose every
+verified chain ends at an anchor `x5c` carries itself (a certificate
+with a configured anchor's subject and public key, such as a
+cross-signed copy of it), with `invalid_client`. An intermediate the
+server also lists as an anchor is accepted when the chain verifies on
+to another anchor, since the wallet can't know which of its CAs the
+server lists. Each RSA key in `x5c` must be at most 4096 bits, with
+exponent 65537. With
 a trust list shared by several attesters, use its
 `AttesterIssuerBoundToAnchor` binding, so each anchor vouches only for
 the attesters it's bound to. Its `LeafPolicy`, by default
diff --git a/internal/claimvalues/claimvalues.go b/internal/claimvalues/claimvalues.go
index f0a5f319..cac3adfd 100644
--- a/internal/claimvalues/claimvalues.go
+++ b/internal/claimvalues/claimvalues.go
@@ -12,7 +12,11 @@ package claimvalues
 import (
 	"bytes"
 	"encoding/json"
-	"reflect"
+	"io"
+	"maps"
+	"math/big"
+	"slices"
+	"strings"
 )
 
 // Acceptable is, for a claim requested with "value", "values" or both,
@@ -53,14 +57,91 @@ func FromRequest(request json.RawMessage) ([]json.RawMessage, bool) {
 }
 
 // Equal reports whether a and b are the same JSON value: equal once
-// decoded, so "1" equals "1.0" and member order doesn't matter. Text
-// that doesn't decode equals nothing.
+// decoded, so "1" equals "1.0" and member order doesn't matter. Numbers
+// compare exactly, by the value their text denotes, not as float64,
+// which would make integers above 2^53 that differ equal. Text that
+// doesn't decode equals nothing.
 func Equal(a, b json.RawMessage) bool {
-	var av, bv any
-	if json.Unmarshal(a, &av) != nil || json.Unmarshal(b, &bv) != nil {
-		return false
+	av, aok := decode(a)
+	bv, bok := decode(b)
+	return aok && bok && equalValues(av, bv)
+}
+
+// decode decodes raw as one JSON value, keeping numbers as their text.
+func decode(raw json.RawMessage) (any, bool) {
+	d := json.NewDecoder(bytes.NewReader(raw))
+	d.UseNumber()
+	var v any
+	if d.Decode(&v) != nil {
+		return nil, false
+	}
+	// Like json.Unmarshal, refuse anything after the value.
+	if _, err := d.Token(); err != io.EOF {
+		return nil, false
+	}
+	return v, true
+}
+
+// equalValues compares two values decode returned.
+func equalValues(a, b any) bool {
+	switch a := a.(type) {
+	case json.Number:
+		b, ok := b.(json.Number)
+		return ok && equalNumbers(a, b)
+	case []any:
+		b, ok := b.([]any)
+		return ok && slices.EqualFunc(a, b, equalValues)
+	case map[string]any:
+		b, ok := b.(map[string]any)
+		return ok && maps.EqualFunc(a, b, equalValues)
+	default:
+		// string, bool or nil.
+		return a == b
+	}
+}
+
+// equalNumbers reports whether two JSON number texts denote the same
+// value, exactly: each is reduced to a sign, its significant digits and
+// a decimal exponent, so "100", "1e2" and "100.0" are equal. The
+// exponent is a big.Int, so neither overflow nor a huge exponent's
+// expansion (as big.Rat or big.Float would compute) is possible.
+func equalNumbers(a, b json.Number) bool {
+	an, aok := canonicalNumber(string(a))
+	bn, bok := canonicalNumber(string(b))
+	return aok && bok && an.negative == bn.negative && an.digits == bn.digits && an.exponent.Cmp(bn.exponent) == 0
+}
+
+// number is a JSON number as ±digits × 10^exponent, with digits
+// free of leading and trailing zeros; zero has no digits, no sign and
+// exponent 0.
+type number struct {
+	negative bool
+	digits   string
+	exponent *big.Int
+}
+
+// canonicalNumber reduces text, a JSON number (RFC 8259 §6) as
+// encoding/json validated it, to a number.
+func canonicalNumber(text string) (number, bool) {
+	negative := strings.HasPrefix(text, "-")
+	text = strings.TrimPrefix(text, "-")
+	mantissa, exp, hasExp := strings.Cut(strings.ToLower(text), "e")
+	exponent := new(big.Int)
+	if hasExp {
+		if _, ok := exponent.SetString(strings.TrimPrefix(exp, "+"), 10); !ok {
+			return number{}, false
+		}
+	}
+	integer, fraction, _ := strings.Cut(mantissa, ".")
+	digits := integer + fraction
+	exponent.Sub(exponent, big.NewInt(int64(len(fraction))))
+	trimmed := strings.TrimRight(digits, "0")
+	exponent.Add(exponent, big.NewInt(int64(len(digits)-len(trimmed))))
+	digits = strings.TrimLeft(trimmed, "0")
+	if digits == "" {
+		return number{exponent: new(big.Int)}, true
 	}
-	return reflect.DeepEqual(av, bv)
+	return number{negative: negative, digits: digits, exponent: exponent}, true
 }
 
 // Allows reports whether name may be released with value under a.
diff --git a/internal/claimvalues/claimvalues_test.go b/internal/claimvalues/claimvalues_test.go
index b60ca8f3..f2660265 100644
--- a/internal/claimvalues/claimvalues_test.go
+++ b/internal/claimvalues/claimvalues_test.go
@@ -38,3 +38,49 @@ func TestFromRequest(t *testing.T) {
 		}
 	}
 }
+
+// TestEqualNumbersExactly covers OIDC Core §5.5.1's equality comparison
+// for numbers: by the value the text denotes, exactly, so integers
+// above 2^53 that float64 would round together stay distinct, while
+// different spellings of one value are equal.
+func TestEqualNumbersExactly(t *testing.T) {
+	for _, tc := range []struct {
+		a, b string
+		want bool
+	}{
+		{`9007199254740993`, `9007199254740992`, false},
+		{`9007199254740993`, `9007199254740993`, true},
+		{`[9007199254740993]`, `[9007199254740992]`, false},
+		{`{"n":9007199254740993}`, `{"n":9007199254740992}`, false},
+		{`0.1000000000000000000001`, `0.1`, false},
+		{`1`, `1.0`, true},
+		{`100`, `1e2`, true},
+		{`100`, `1E+2`, true},
+		{`0.01`, `1e-2`, true},
+		{`1.50`, `15e-1`, true},
+		{`-1`, `1`, false},
+		{`0`, `-0.0`, true},
+		{`0`, `0e5`, true},
+		{`1e400`, `1e400`, true},
+		{`1e400`, `1e401`, false},
+		{`1e99999999999999999999`, `10e99999999999999999998`, true},
+		{`1`, `"1"`, false},
+		{`"A"`, `"A"`, true},
+		{`{"x":[1,{"y":2}]}`, `{"x":[1.0,{"y":2e0}]}`, true},
+		{`[1,2]`, `[1,2,3]`, false},
+		{`null`, `null`, true},
+		{`1 2`, `1`, false},
+		{`1x`, `1`, false},
+	} {
+		if got := Equal(json.RawMessage(tc.a), json.RawMessage(tc.b)); got != tc.want {
+			t.Errorf("Equal(%s, %s) = %v, want %v", tc.a, tc.b, got, tc.want)
+		}
+		if got := Equal(json.RawMessage(tc.b), json.RawMessage(tc.a)); got != tc.want {
+			t.Errorf("Equal(%s, %s) = %v, want %v", tc.b, tc.a, got, tc.want)
+		}
+	}
+	a := Acceptable{"account_no": {json.RawMessage(`9007199254740993`)}}
+	if a.Allows("account_no", json.RawMessage(`9007199254740992`)) {
+		t.Error("Allows released 9007199254740992 for a request of value 9007199254740993")
+	}
+}
diff --git a/internal/jose/callerkey.go b/internal/jose/callerkey.go
index aa37b89a..51ece51f 100644
--- a/internal/jose/callerkey.go
+++ b/internal/jose/callerkey.go
@@ -57,3 +57,16 @@ func checkCallerKeyMaterial(pub crypto.PublicKey) error {
 	}
 	return nil
 }
+
+// ValidateCallerCertificateKey checks pub, the public key of a
+// certificate a caller supplied — one in an attestation's "x5c" chain,
+// say — against the key-material rules ParseJWK applies to a caller's
+// key, whatever algorithm the certificate is used with: an RSA modulus
+// of at most 4096 bits (maxCallerRSAModulusBits) and exponent 65537.
+// Run it before the certificate's key verifies anything, path building
+// included: crypto/x509 accepts any modulus size and exponents up to
+// 2^31-1, so an unchecked certificate lets the caller choose how much
+// CPU each signature check costs.
+func ValidateCallerCertificateKey(pub crypto.PublicKey) error {
+	return checkCallerKeyMaterial(pub)
+}
diff --git a/server/attested_client.go b/server/attested_client.go
index 0ce61de6..9c63a4aa 100644
--- a/server/attested_client.go
+++ b/server/attested_client.go
@@ -48,7 +48,9 @@ type AttestedClient struct {
 	Client storage.RegisteredClient
 
 	// AttestationExpiresAt is when the verified Client Attestation
-	// expires.
+	// expires. IssueRefreshToken and IssueAccessToken refuse a Client
+	// whose AttestationExpiresAt was changed since: they judge the
+	// attestation's expiry by their own copy of it.
 	AttestationExpiresAt time.Time
 
 	// instanceKey is the RFC 7638 thumbprint of the Client Instance Key
@@ -57,8 +59,11 @@ type AttestedClient struct {
 	// this server authenticated carries one. authenticatedID is the
 	// client it was verified for: IssueRefreshToken refuses a Client
 	// changed since, so the key can't be attached to another client.
-	instanceKey     string
-	authenticatedID fapi.ClientID
+	// verifiedExpiresAt is AttestationExpiresAt as verified, which they
+	// compare it with and judge expiry by.
+	instanceKey       string
+	authenticatedID   fapi.ClientID
+	verifiedExpiresAt time.Time
 }
 
 // AuthenticateAttestedClient authenticates a client with a Client
@@ -108,7 +113,7 @@ func (s *Server) AuthenticateAttestedClient(ctx context.Context, req AttestedCli
 	if req.malformed {
 		err = newError(ErrorInvalidRequest, 400, "the request's parameters are duplicated, too many, or too large", nil)
 	} else if req.otherClientAuth {
-		err = newError(ErrorInvalidRequest, 400, "the request uses more than one client authentication method", nil)
+		err = newError(ErrorInvalidRequest, 400, "a client attestation cannot be combined with another client authentication method", nil)
 	} else if err == nil && attestation == "" {
 		err = newError(ErrorInvalidClient, 401, "client authentication is required", nil)
 	}
@@ -122,5 +127,5 @@ func (s *Server) AuthenticateAttestedClient(ctx context.Context, req AttestedCli
 		return AttestedClient{}, err
 	}
 	s.audit(ctx, AuditEventAuthenticateAttestedClient, client.ID(), AuditOutcomeSuccess, "")
-	return AttestedClient{Client: client, AttestationExpiresAt: verified.ExpiresAt, instanceKey: verified.InstanceKey, authenticatedID: client.ID()}, nil
+	return AttestedClient{Client: client, AttestationExpiresAt: verified.ExpiresAt, instanceKey: verified.InstanceKey, authenticatedID: client.ID(), verifiedExpiresAt: verified.ExpiresAt}, nil
 }
diff --git a/server/attester_chain_fuzz_test.go b/server/attester_chain_fuzz_test.go
index fafef382..668cbdf1 100644
--- a/server/attester_chain_fuzz_test.go
+++ b/server/attester_chain_fuzz_test.go
@@ -105,7 +105,7 @@ func attesterChainRefusedOracle(chain []*x509.Certificate) bool {
 }
 
 // FuzzAttesterLeafPolicy checks DefaultAttesterLeafPolicy and
-// checkX5CExcludesAnchors on chains of certificates whose extended key
+// checkX5CReachesUnsentAnchor on chains of certificates whose extended key
 // usages, and shapes, come from the fuzzer. Beyond never panicking on
 // an empty or odd chain:
 //
@@ -113,9 +113,9 @@ func attesterChainRefusedOracle(chain []*x509.Certificate) bool {
 //     documented rule (attesterChainRefusedOracle) refuses;
 //   - approvedAttesterChains keeps exactly the chains the policy
 //     accepts, in order, and fails closed when it keeps none;
-//   - checkX5CExcludesAnchors refuses exactly when an x5c certificate
-//     below the leaf has the subject and public key of the last
-//     certificate of some chain.
+//   - checkX5CReachesUnsentAnchor refuses exactly when every chain's
+//     last certificate has the subject and public key of an x5c
+//     certificate below the leaf.
 func FuzzAttesterLeafPolicy(f *testing.F) {
 	f.Add([]byte{})
 	f.Add([]byte{1, 0, 0, 0})
@@ -179,16 +179,16 @@ func checkX5CAnchorRule(t *testing.T, extra []*x509.Certificate, chains [][]*x50
 	// A certificate is identified, for path building, by its subject
 	// and public key together.
 	type identity struct{ subject, key string }
-	anchors := map[identity]bool{}
-	for _, c := range nonEmpty {
-		a := c[len(c)-1]
-		anchors[identity{string(a.RawSubject), string(a.RawSubjectPublicKeyInfo)}] = true
+	sent := map[identity]bool{}
+	for _, e := range extra {
+		sent[identity{string(e.RawSubject), string(e.RawSubjectPublicKeyInfo)}] = true
 	}
-	want := slices.ContainsFunc(extra, func(e *x509.Certificate) bool {
-		return anchors[identity{string(e.RawSubject), string(e.RawSubjectPublicKeyInfo)}]
+	want := !slices.ContainsFunc(nonEmpty, func(c []*x509.Certificate) bool {
+		a := c[len(c)-1]
+		return !sent[identity{string(a.RawSubject), string(a.RawSubjectPublicKeyInfo)}]
 	})
-	if err := checkX5CExcludesAnchors(extra, nonEmpty); (err != nil) != want {
-		t.Fatalf("checkX5CExcludesAnchors = %v, want refusal %v", err, want)
+	if err := checkX5CReachesUnsentAnchor(extra, nonEmpty); (err != nil) != want {
+		t.Fatalf("checkX5CReachesUnsentAnchor = %v, want refusal %v", err, want)
 	}
 }
 
@@ -288,7 +288,8 @@ func newAttesterPool(f *testing.F) attesterPool {
 //   - no self-signed certificate, and nothing that isn't a certificate,
 //     anywhere in x5c;
 //   - chains that each start at that certificate and end at one of the
-//     configured anchors, none of which x5c carries below the leaf.
+//     configured anchors, at least one of which x5c doesn't carry
+//     below the leaf.
 func FuzzVerifyAttesterChain(f *testing.F) {
 	pool := newAttesterPool(f)
 	f.Add([]byte{poolLeaf, poolIntermediate}, uint8(1<<poolRoot))
@@ -341,22 +342,26 @@ func checkVerifiedAttesterChain(t *testing.T, pool attesterPool, shape []byte, a
 	if len(chains) == 0 {
 		t.Fatalf("accepted x5c %v with no verified chain", shape)
 	}
+	reachesUnsent := false
 	for _, chain := range chains {
-		checkVerifiedChainAnchor(t, pool, shape, anchors, leaf, chain)
+		if !checkVerifiedChainAnchor(t, pool, shape, anchors, leaf, chain) {
+			reachesUnsent = true
+		}
+	}
+	if !reachesUnsent {
+		t.Fatalf("accepted x5c %v, which carries the anchor of every verified chain", shape)
 	}
 }
 
 // checkVerifiedChainAnchor checks chain runs from leaf to one of
-// anchors, which x5c (shape) doesn't carry.
-func checkVerifiedChainAnchor(t *testing.T, pool attesterPool, shape []byte, anchors []*x509.Certificate, leaf *x509.Certificate, chain []*x509.Certificate) {
+// anchors, and reports whether x5c (shape) carries that anchor.
+func checkVerifiedChainAnchor(t *testing.T, pool attesterPool, shape []byte, anchors []*x509.Certificate, leaf *x509.Certificate, chain []*x509.Certificate) (sent bool) {
 	t.Helper()
 	anchor := chain[len(chain)-1]
 	if !chain[0].Equal(leaf) || !slices.ContainsFunc(anchors, anchor.Equal) {
 		t.Fatalf("x5c %v: a chain doesn't run from the signing certificate to a configured anchor", shape)
 	}
-	for _, s := range shape[1:] {
-		if pool.certs[int(s)%poolSize].Equal(anchor) {
-			t.Fatalf("accepted x5c %v, which carries anchor %q", shape, anchor.Subject)
-		}
-	}
+	return slices.ContainsFunc(shape[1:], func(s byte) bool {
+		return pool.certs[int(s)%poolSize].Equal(anchor)
+	})
 }
diff --git a/server/attester_trust.go b/server/attester_trust.go
index 9f71873c..ce0f4f16 100644
--- a/server/attester_trust.go
+++ b/server/attester_trust.go
@@ -17,6 +17,7 @@ import (
 	fapi "github.com/idfoundry/fapigo"
 	"github.com/idfoundry/fapigo/internal/clientattestation"
 	"github.com/idfoundry/fapigo/internal/depcheck"
+	"github.com/idfoundry/fapigo/internal/jose"
 	"github.com/idfoundry/fapigo/keys"
 	"github.com/idfoundry/fapigo/storage"
 )
@@ -130,6 +131,12 @@ func (r RegisteredAttesterKeys) validate() error {
 // fallback to "kid", which would let an attestation skip the chain
 // check just by omitting it — and "kid" plays no part.
 //
+// Every "x5c" certificate holding an RSA key must hold one of at most
+// 4096 bits with exponent 65537, the limits on any RSA key a caller
+// supplies; this is checked before any signature, so a chain can't
+// choose how much work verifying it costs. Anchors TrustAnchors or
+// Anchors return are configured, not sent, and aren't limited.
+//
 // The signing certificate must:
 //
 //   - chain to one of the anchors through the other "x5c" certificates,
@@ -138,12 +145,16 @@ func (r RegisteredAttesterKeys) validate() error {
 //     the trust anchor out of "x5c" and rejects self-signed signing
 //     certificates wherever else it uses x5c, so the signing key can be
 //     rotated or revoked without redistributing anchors;
-//   - come with intermediates only: "x5c" must not include the trust
-//     anchor (HAIP 1.0), so an attestation is refused when any other
-//     "x5c" certificate is self-signed, or has the subject and public
-//     key of the anchor a verified chain ends at — even an anchor that
-//     is not self-signed, such as an intermediate configured as an
-//     anchor, and even a re-issued or cross-signed copy of it;
+//   - come with intermediates: HAIP 1.0 §4.4.1 has the wallet leave
+//     the trust anchor out of "x5c", so an attestation is refused when
+//     any other "x5c" certificate is self-signed, or when every
+//     verified chain ends at an anchor the wallet sent — one with the
+//     subject and public key of an "x5c" certificate, such as an
+//     intermediate configured as an anchor, or a re-issued or
+//     cross-signed copy of it. One chain ending at an anchor not in
+//     "x5c" is enough: with anchors {root, intermediate}, x5c [leaf,
+//     intermediate] is accepted, since it verifies on to root and the
+//     wallet can't know which of its CAs the server lists;
 //   - permit digital signatures, if it restricts key usage at all;
 //   - hold a key of the type the client's registered attestation
 //     algorithm needs.
@@ -552,6 +563,12 @@ func verifyAttesterChain(ders [][]byte, roots *x509.CertPool, now time.Time) (*x
 		if err != nil {
 			return nil, nil, fmt.Errorf("parse x5c certificate %d: %w", i, err)
 		}
+		// Before any of these keys checks a signature (isSelfSigned,
+		// path building): the caller chose them, and crypto/x509 bounds
+		// neither an RSA modulus nor its exponent.
+		if err := jose.ValidateCallerCertificateKey(cert.PublicKey); err != nil {
+			return nil, nil, fmt.Errorf("x5c certificate %d: %w", i, err)
+		}
 		certs[i] = cert
 	}
 	leaf := certs[0]
@@ -569,10 +586,11 @@ func verifyAttesterChain(ders [][]byte, roots *x509.CertPool, now time.Time) (*x
 	}
 	intermediates := x509.NewCertPool()
 	for i, c := range certs[1:] {
-		// HAIP 1.0 keeps the trust anchor out of x5c; a self-signed
-		// certificate there can only be an anchor, configured or not.
+		// HAIP 1.0 has the wallet keep the trust anchor out of x5c; a
+		// self-signed certificate there can only be an anchor,
+		// configured or not.
 		if isSelfSigned(c) {
-			return nil, nil, fmt.Errorf("attester x5c must not include the trust anchor (HAIP 1.0): x5c certificate %d is self-signed", i+1)
+			return nil, nil, fmt.Errorf("attester x5c must not include a self-signed certificate (HAIP 1.0 keeps the trust anchor out): x5c certificate %d is self-signed", i+1)
 		}
 		intermediates.AddCert(c)
 	}
@@ -587,34 +605,34 @@ func verifyAttesterChain(ders [][]byte, roots *x509.CertPool, now time.Time) (*x
 	if err != nil {
 		return nil, nil, fmt.Errorf("attester certificate chain does not verify: %w", err)
 	}
-	if err := checkX5CExcludesAnchors(certs[1:], chains); err != nil {
+	if err := checkX5CReachesUnsentAnchor(certs[1:], chains); err != nil {
 		return nil, nil, err
 	}
 	return leaf, chains, nil
 }
 
-// checkX5CExcludesAnchors refuses x5c certificates (below the leaf)
-// for the anchor any verified chain ends at — an anchor that is not
-// self-signed, such as an intermediate configured as an anchor. A
-// certificate with the anchor's subject and public key is the anchor
-// for path building, whatever else differs, so a copy re-issued by the
-// anchor's own issuer or cross-signed by another CA is refused just as
-// the configured certificate is. It looks at every verified chain, not
-// only those LeafPolicy or the issuer binding later keep, so an x5c
-// that carries an anchor is refused whichever chain would otherwise be
-// used. A pool's anchors can't be listed, so only those a chain reached
-// are compared.
-func checkX5CExcludesAnchors(extra []*x509.Certificate, chains [][]*x509.Certificate) error {
+// checkX5CReachesUnsentAnchor refuses an x5c (extra, the certificates
+// below the leaf) when every verified chain ends at an anchor the
+// wallet sent itself. A certificate with the anchor's subject and
+// public key is the anchor for path building, whatever else differs,
+// so a copy re-issued by the anchor's own issuer or cross-signed by
+// another CA counts as sending it just as the configured certificate
+// does. One chain ending at an anchor not in x5c is enough, as when the
+// x5c intermediate is also configured as an anchor but verifies on to
+// a root: the wallet can't know which of its CAs the server lists, and
+// every chain ends at a configured anchor anyway. A pool's anchors
+// can't be listed, so only those a chain reached are compared.
+func checkX5CReachesUnsentAnchor(extra []*x509.Certificate, chains [][]*x509.Certificate) error {
 	for _, chain := range chains {
 		// x509.Certificate.Verify never returns an empty chain.
 		anchor := chain[len(chain)-1]
-		for i, c := range extra {
-			if bytes.Equal(c.RawSubject, anchor.RawSubject) && bytes.Equal(c.RawSubjectPublicKeyInfo, anchor.RawSubjectPublicKeyInfo) {
-				return fmt.Errorf("attester x5c must not include the trust anchor (HAIP 1.0): x5c certificate %d is an anchor", i+1)
-			}
+		if !slices.ContainsFunc(extra, func(c *x509.Certificate) bool {
+			return bytes.Equal(c.RawSubject, anchor.RawSubject) && bytes.Equal(c.RawSubjectPublicKeyInfo, anchor.RawSubjectPublicKeyInfo)
+		}) {
+			return nil
 		}
 	}
-	return nil
+	return errors.New("attester x5c includes the trust anchor every verified chain ends at (HAIP 1.0 has the wallet leave it out)")
 }
 
 // isSelfSigned reports whether cert is signed by its own key —
diff --git a/server/attester_trust_test.go b/server/attester_trust_test.go
index 769dec2b..441d69f9 100644
--- a/server/attester_trust_test.go
+++ b/server/attester_trust_test.go
@@ -239,12 +239,15 @@ func TestX5CAttesterChainRejectsUntrustedAttestation(t *testing.T) {
 	}
 }
 
-// TestX5CAttesterChainRefusesAnchorInX5C covers HAIP 1.0 keeping the
-// trust anchor out of x5c: a self-signed certificate below the leaf,
-// configured as an anchor or not, and a configured anchor that is not
-// self-signed (an intermediate trusted directly), under both a
-// TrustAnchors pool and AttesterIssuerBoundToAnchor, are refused, while
-// the leaf alone or with its intermediates is accepted.
+// TestX5CAttesterChainRefusesAnchorInX5C covers HAIP 1.0 having the
+// wallet keep the trust anchor out of x5c: a self-signed certificate
+// below the leaf, configured as an anchor or not, is refused, and so is
+// a configured anchor that is not self-signed (an intermediate trusted
+// directly) when every verified chain ends at it, under both a
+// TrustAnchors pool and AttesterIssuerBoundToAnchor. The leaf alone or
+// with its intermediates is accepted, including an intermediate that
+// is also an anchor when the chain verifies on to another anchor the
+// wallet didn't send: the wallet can't know which CAs the server lists.
 func TestX5CAttesterChainRefusesAnchorInX5C(t *testing.T) {
 	root := newTestCert(t, "root", certOptions{isCA: true})
 	intermediate := newTestCert(t, "intermediate", certOptions{parent: &root, isCA: true})
@@ -273,7 +276,9 @@ func TestX5CAttesterChainRefusesAnchorInX5C(t *testing.T) {
 		"leaf, root, bound":                             {bound(root), attesterLeaf{leafFromRoot, x5cOf(leafFromRoot, root)}, false},
 		"intermediate anchor in x5c, pool":              {pool(intermediate), attesterLeaf{leafFromIntermediate, x5cOf(leafFromIntermediate, intermediate)}, false},
 		"intermediate anchor in x5c, bound":             {bound(intermediate), attesterLeaf{leafFromIntermediate, x5cOf(leafFromIntermediate, intermediate)}, false},
-		"intermediate anchor in x5c, root also anchor":  {pool(root, intermediate), attesterLeaf{leafFromIntermediate, x5cOf(leafFromIntermediate, intermediate)}, false},
+		"intermediate anchor in x5c, root also anchor":  {pool(root, intermediate), attesterLeaf{leafFromIntermediate, x5cOf(leafFromIntermediate, intermediate)}, true},
+		"intermediate anchor in x5c, root also bound":   {bound(root, intermediate), attesterLeaf{leafFromIntermediate, x5cOf(leafFromIntermediate, intermediate)}, true},
+		"leaf, intermediate, root, both anchors":        {pool(root, intermediate), attesterLeaf{leafFromIntermediate, x5cOf(leafFromIntermediate, intermediate, root)}, false},
 		"self-signed certificate that is not an anchor": {pool(root), attesterLeaf{leafFromIntermediate, x5cOf(leafFromIntermediate, intermediate, stray)}, false},
 		"leaf, intermediate":                            {pool(root), attesterLeaf{leafFromIntermediate, x5cOf(leafFromIntermediate, intermediate)}, true},
 		"leaf, intermediate, bound":                     {bound(root), attesterLeaf{leafFromIntermediate, x5cOf(leafFromIntermediate, intermediate)}, true},
@@ -581,3 +586,118 @@ func TestRegisteredAttesterKeysNoKeyForAlgorithm(t *testing.T) {
 		t.Fatalf("error code = %q, want %q (err %v)", code, server.ErrorInvalidClient, err)
 	}
 }
+
+// TestX5CAttesterChainRefusesUnboundedRSAKeys covers an x5c whose
+// certificates carry RSA keys the caller chose to be costly: a modulus
+// over 4096 bits or an exponent other than 65537, on the signing
+// certificate or on an "intermediate" it names as its issuer. Nothing
+// chains to the anchor, and the moduli were never generated, so a
+// refusal from chain verification would be x509's unknown authority
+// after one costly RSA operation per candidate; the key limits must
+// refuse each first, without any signature check.
+func TestX5CAttesterChainRefusesUnboundedRSAKeys(t *testing.T) {
+	root := newTestCert(t, "trust list CA", certOptions{isCA: true})
+	trust := server.X5CAttesterChain{Revocation: server.NoClientCertificateRevocationCheck{}, TrustAnchors: server.StaticAttesterTrustAnchors{Roots: poolOf(root)}, IssuerBinding: server.AttesterIssuerInCertificate}
+	// An RSA signer, so the certificates' signature algorithm is one the
+	// costly RSA key would be used for.
+	signer, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("rsa.GenerateKey: %v", err)
+	}
+	for name, tc := range map[string]struct {
+		bits     int
+		exponent int
+		onLeaf   bool
+		want     error
+	}{
+		"31744-bit intermediate, exponent 2^31-1": {31744, 1<<31 - 1, false, jose.ErrRSAKeyTooLarge},
+		"4104-bit intermediate":                   {4104, 65537, false, jose.ErrRSAKeyTooLarge},
+		"intermediate with exponent 2^31-1":       {2048, 1<<31 - 1, false, jose.ErrUnsupportedRSAExponent},
+		"intermediate with exponent 3":            {2048, 3, false, jose.ErrUnsupportedRSAExponent},
+		"8192-bit signing certificate":            {8192, 65537, true, jose.ErrRSAKeyTooLarge},
+		"signing certificate with exponent 3":     {2048, 3, true, jose.ErrUnsupportedRSAExponent},
+	} {
+		t.Run(name, func(t *testing.T) {
+			h := newHarnessWithAttesterTrust(t, nil, trust)
+			x5c, err := json.Marshal(costlyRSAX5C(t, signer, tc.bits, tc.exponent, tc.onLeaf)) // []byte marshals as standard base64
+			if err != nil {
+				t.Fatalf("marshal x5c: %v", err)
+			}
+			instanceKey := generateKey(t)
+			err = requestWithAttestation(t, h, createX5CAttestation(t, generateKey(t), x5c, "", &instanceKey.PublicKey, h.now), instanceKey)
+			if code := serverErrorCode(t, err); code != server.ErrorInvalidClient {
+				t.Fatalf("error code = %q, want %q (err %v)", code, server.ErrorInvalidClient, err)
+			}
+			if !errors.Is(err, tc.want) {
+				t.Fatalf("err = %v, want it to wrap %v (refused by the key limits, before any signature check)", err, tc.want)
+			}
+		})
+	}
+}
+
+// costlyRSAX5C builds an attacker's x5c around an RSA public key with a
+// random (never generated) modulus of the given bits and exponent,
+// signed by signer:
+// either as the signing certificate's own key, or as the key of an
+// "intermediate" the signing certificate names as its issuer, whose
+// signature is then junk as long as that modulus.
+func costlyRSAX5C(t *testing.T, signer *rsa.PrivateKey, bits, exponent int, onLeaf bool) [][]byte {
+	t.Helper()
+	n, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), uint(bits)))
+	if err != nil {
+		t.Fatalf("rand.Int: %v", err)
+	}
+	n.SetBit(n, bits-1, 1)
+	n.SetBit(n, 0, 1)
+	costly := &rsa.PublicKey{N: n, E: exponent}
+	now := time.Now()
+	issuer := pkix.Name{CommonName: "attester CA"}
+	leafTemplate := &x509.Certificate{
+		SerialNumber: big.NewInt(1), Subject: pkix.Name{CommonName: "attester"},
+		NotBefore: now.Add(-time.Hour), NotAfter: now.Add(time.Hour),
+		KeyUsage: x509.KeyUsageDigitalSignature,
+	}
+	if onLeaf {
+		der, err := x509.CreateCertificate(rand.Reader, leafTemplate, &x509.Certificate{Subject: issuer}, costly, signer)
+		if err != nil {
+			t.Fatalf("create leaf: %v", err)
+		}
+		return [][]byte{der}
+	}
+	leafDER, err := x509.CreateCertificate(rand.Reader, leafTemplate, &x509.Certificate{Subject: issuer}, signer.Public(), signer)
+	if err != nil {
+		t.Fatalf("create leaf: %v", err)
+	}
+	intermediateDER, err := x509.CreateCertificate(rand.Reader, &x509.Certificate{
+		SerialNumber: big.NewInt(2), Subject: issuer,
+		NotBefore: now.Add(-time.Hour), NotAfter: now.Add(time.Hour),
+		IsCA: true, BasicConstraintsValid: true, KeyUsage: x509.KeyUsageCertSign,
+	}, &x509.Certificate{Subject: pkix.Name{CommonName: "root"}}, costly, signer)
+	if err != nil {
+		t.Fatalf("create intermediate: %v", err)
+	}
+	return [][]byte{withJunkSignature(t, leafDER, bits), intermediateDER}
+}
+
+// withJunkSignature replaces der's signature with bits/8 random bytes,
+// as long as an RSA signature by a key of that modulus would be.
+func withJunkSignature(t *testing.T, der []byte, bits int) []byte {
+	t.Helper()
+	var cert struct {
+		TBS    asn1.RawValue
+		SigAlg pkix.AlgorithmIdentifier
+		Sig    asn1.BitString
+	}
+	if _, err := asn1.Unmarshal(der, &cert); err != nil {
+		t.Fatalf("unmarshal certificate: %v", err)
+	}
+	sig := make([]byte, bits/8)
+	_, _ = rand.Read(sig)
+	sig[0] = 0x01
+	cert.Sig = asn1.BitString{Bytes: sig, BitLength: bits}
+	out, err := asn1.Marshal(cert)
+	if err != nil {
+		t.Fatalf("marshal certificate: %v", err)
+	}
+	return out
+}
diff --git a/server/client_auth_attestation_test.go b/server/client_auth_attestation_test.go
index 3f1221fc..0669e4bb 100644
--- a/server/client_auth_attestation_test.go
+++ b/server/client_auth_attestation_test.go
@@ -7,6 +7,7 @@ import (
 	"crypto/ed25519"
 	"crypto/rand"
 	"encoding/json"
+	"errors"
 	"testing"
 	"time"
 
@@ -899,10 +900,26 @@ func TestAttestationWithClientAssertionRefused(t *testing.T) {
 			if code := serverErrorCode(t, err); code != server.ErrorInvalidRequest {
 				t.Fatalf("RequestClientCredentialsToken code %q, want invalid_request", code)
 			}
+			checkAttestationCombinedDescription(t, err)
 		})
 	}
 }
 
+// checkAttestationCombinedDescription checks err's error_description
+// says why: an attestation as an additional signal beside another
+// client authentication method (draft-12 §7.6) isn't supported.
+func checkAttestationCombinedDescription(t *testing.T, err error) {
+	t.Helper()
+	var srvErr *server.Error
+	if !errors.As(err, &srvErr) {
+		t.Fatalf("error %v is not a *server.Error", err)
+	}
+	const want = "a client attestation cannot be combined with another client authentication method"
+	if got := srvErr.PublicDescription(); got != want {
+		t.Fatalf("error_description = %q, want %q", got, want)
+	}
+}
+
 // TestAuthenticateAttestedClientWithClientAssertionRefused is
 // TestAttestationWithClientAssertionRefused for AuthenticateAttestedClient,
 // given a request from TokenEndpointRequest.AttestedClientAuthentication.
@@ -921,4 +938,5 @@ func TestAuthenticateAttestedClientWithClientAssertionRefused(t *testing.T) {
 	if code := serverErrorCode(t, err); code != server.ErrorInvalidRequest {
 		t.Fatalf("AuthenticateAttestedClient code %q, want invalid_request", code)
 	}
+	checkAttestationCombinedDescription(t, err)
 }
diff --git a/server/config.go b/server/config.go
index f92c0fee..dfd56cc5 100644
--- a/server/config.go
+++ b/server/config.go
@@ -452,11 +452,13 @@ type Config struct {
 	// server accepts, beyond the standard OAuth/OIDC/PKCE parameters it
 	// already understands (response_type, client_id, redirect_uri,
 	// scope, state, nonce, code_challenge, code_challenge_method). A
-	// parameter with no registered Definition is rejected — there is no
-	// permissive fallback — so nil is equivalent to an empty Registry
-	// (no custom parameters accepted at all), not to "extensions
-	// disabled, accept anything." See ARCHITECTURE.md design rules
-	// 10-11 and extension.Registry.Parse.
+	// parameter with no registered Definition is ignored and stripped
+	// from the request (RFC 6749 §3.1: an authorization server "MUST
+	// ignore unrecognized request parameters"), so it never reaches
+	// storage, an InteractionRequest or a token; only a registered one
+	// is parsed, validated and kept. nil is equivalent to an empty
+	// Registry: no custom parameter is kept. See ARCHITECTURE.md design
+	// rules 10-11 and extension.Registry.Parse.
 	//
 	// A Definition whose AllowedSources permits SourcePlainParameter
 	// must use a string-shaped T: this server's plain-parameter path
@@ -471,10 +473,10 @@ type Config struct {
 	// on PAR, CIBA backchannel authentication requests, and
 	// client_credentials token requests (RFC 9396 §6). Unlike
 	// Extensions, nil is not equivalent to an empty registry accepting
-	// nothing extra — it means "authorization_details" itself is
-	// rejected outright as an unregistered parameter, the same
-	// default-reject stance Extensions takes for any parameter without a
-	// matching Definition. A registered RARRegistry's own bounds (total
+	// nothing extra: it means a request carrying "authorization_details"
+	// at all is refused with invalid_authorization_details (RFC 9396
+	// §5), rather than the parameter being ignored as an unregistered
+	// Extensions parameter is. A registered RARRegistry's own bounds (total
 	// size, nesting depth, per-type object count and size) apply
 	// identically to both flows. Each client requests only the types its
 	// registration lists (storage.RegisteredClientConfig.
@@ -589,6 +591,14 @@ type Config struct {
 	// only private_key_jwt and mTLS. It's here for HAIP and OpenID4VCI
 	// wallets; don't register a client that must be FAPI 2.0 compliant
 	// for it.
+	//
+	// The attestation is supported only as the client authentication
+	// method, not as the additional security signal beside another
+	// method that draft-12 §7.6 allows: a request carrying attestation
+	// headers together with a client_assertion or client_assertion_type
+	// is refused with invalid_request (RFC 6749 §2.3: one method per
+	// request), so an assertion naming another client can't be ignored
+	// in favour of the attestation.
 	AttestationBasedClientAuthentication bool
 
 	// OAuthOnly, if set, makes this server a pure OAuth 2.0 + FAPI 2.0
diff --git a/server/embedder_access_token.go b/server/embedder_access_token.go
index ef9b626b..0a564b78 100644
--- a/server/embedder_access_token.go
+++ b/server/embedder_access_token.go
@@ -27,7 +27,8 @@ type IssueAccessTokenRequest struct {
 	// Binding is the token request's sender-constraining credential,
 	// exactly as VerifyTokenRequestBinding returned it for Client: the
 	// access token is bound to it (its "cnf" claim), so one built by
-	// hand, or verified for another client, is refused.
+	// hand, verified for another client, or whose Thumbprint was
+	// changed since, is refused.
 	Binding TokenBinding
 
 	// Subject is the access token's sub.
@@ -82,7 +83,7 @@ type IssueAccessTokenRequest struct {
 func (s *Server) IssueAccessToken(ctx context.Context, req IssueAccessTokenRequest) (TokenResult, error) {
 	client := req.Client.Client
 	grant, err := s.embedderGrant(ctx, embedderGrantRequest(req))
-	if err == nil && req.Binding.verifiedFor != client.ID() {
+	if err == nil && (req.Binding.verifiedFor != client.ID() || req.Binding.Thumbprint != req.Binding.verifiedThumbprint) {
 		err = newError(ErrorServerError, 500, "Binding must be as VerifyTokenRequestBinding returned it for Client", nil)
 	}
 	if err != nil {
diff --git a/server/embedder_access_token_test.go b/server/embedder_access_token_test.go
index f2527873..76da164d 100644
--- a/server/embedder_access_token_test.go
+++ b/server/embedder_access_token_test.go
@@ -294,6 +294,12 @@ func TestIssueAccessTokenRefusals(t *testing.T) {
 			r.Binding = server.TokenBinding{Thumbprint: r.Binding.Thumbprint, SenderConstrain: r.Binding.SenderConstrain}
 		}, server.ErrorServerError},
 		"binding verified for another client": {func(r *server.IssueAccessTokenRequest) { r.Binding = otherClientBinding }, server.ErrorServerError},
+		"binding thumbprint edited": {func(r *server.IssueAccessTokenRequest) {
+			r.Binding.Thumbprint = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" // a key nobody proved
+		}, server.ErrorServerError},
+		"attestation expiry edited": {func(r *server.IssueAccessTokenRequest) {
+			r.Client.AttestationExpiresAt = r.Client.AttestationExpiresAt.Add(time.Hour)
+		}, server.ErrorServerError},
 		"grant type not configured":           {func(r *server.IssueAccessTokenRequest) { r.GrantType = "authorization_code" }, server.ErrorServerError},
 		"client not authenticated":            {func(r *server.IssueAccessTokenRequest) { r.Client = server.AttestedClient{Client: r.Client.Client} }, server.ErrorServerError},
 		"client swapped after authentication": {func(r *server.IssueAccessTokenRequest) { r.Client.Client = otherClient }, server.ErrorServerError},
@@ -397,6 +403,12 @@ func TestEmbedderGrantRefusesExpiredAttestation(t *testing.T) {
 	if _, err := past.IssueRefreshToken(context.Background(), server.IssueRefreshTokenRequest(req)); serverErrorCode(t, err) != server.ErrorServerError {
 		t.Errorf("IssueRefreshToken past the attestation's exp = %v, want server_error", err)
 	}
+	// Moving AttestationExpiresAt on doesn't make a kept Client current.
+	extended := req
+	extended.Client.AttestationExpiresAt = extended.Client.AttestationExpiresAt.Add(time.Hour)
+	if _, err := past.IssueRefreshToken(context.Background(), server.IssueRefreshTokenRequest(extended)); serverErrorCode(t, err) != server.ErrorServerError {
+		t.Errorf("IssueRefreshToken with AttestationExpiresAt edited = %v, want server_error", err)
+	}
 }
 
 // TestEmbedderGrantRefusesRevokedGrantID: a GrantID already revoked
diff --git a/server/embedder_refresh.go b/server/embedder_refresh.go
index 07a26036..8807bd54 100644
--- a/server/embedder_refresh.go
+++ b/server/embedder_refresh.go
@@ -128,9 +128,9 @@ func (s *Server) embedderGrant(ctx context.Context, req embedderGrantRequest) (g
 	switch {
 	case !slices.Contains(s.cfg.AdditionalGrantTypes, req.GrantType):
 		return grantRecord{}, newError(ErrorServerError, 500, "GrantType is not one of Config.AdditionalGrantTypes", nil)
-	case req.Client.instanceKey == "" || req.Client.authenticatedID != client.ID():
+	case req.Client.instanceKey == "" || req.Client.authenticatedID != client.ID() || !req.Client.AttestationExpiresAt.Equal(req.Client.verifiedExpiresAt):
 		return grantRecord{}, newError(ErrorServerError, 500, "Client must be as AuthenticateAttestedClient returned it", nil)
-	case s.deps.Clock.Now().After(req.Client.AttestationExpiresAt.Add(s.cfg.Limits.MaxClockSkew)):
+	case s.deps.Clock.Now().After(req.Client.verifiedExpiresAt.Add(s.cfg.Limits.MaxClockSkew)):
 		// AuthenticateAttestedClient accepted the attestation up to
 		// MaxClockSkew past its exp; past that, Client was kept from an
 		// earlier request rather than authenticated for this one.
diff --git a/server/extension_grants.go b/server/extension_grants.go
index 2c760c3c..5e21c2a1 100644
--- a/server/extension_grants.go
+++ b/server/extension_grants.go
@@ -28,7 +28,8 @@ func (t TokenEndpointRequest) Parameters() (map[string]string, error) {
 }
 
 // Resources returns the request's RFC 8707 "resource" parameters, in
-// order: every one the client sent, which is what a check of the
+// order: every one the client sent with a value (an empty one is
+// omitted, RFC 6749 §3.2), which is what a check of the
 // resources an embedder's grant may be used for has to look at. Pass
 // them as IssueAccessTokenRequest.Resources and
 // IssueRefreshTokenRequest.Resources, which refuse any the client or
@@ -75,7 +76,8 @@ func (t TokenEndpointRequest) AttestedClientAuthentication() AttestedClientAuthe
 // returned, for the same client: the access token is bound to its
 // Thumbprint, so a hand-built one, or one verified for another client,
 // would bind it to a key that never proved possession at the token
-// endpoint. IssueRefreshToken records Thumbprint for reference only, so
+// endpoint. It keeps its own copy of the thumbprint it verified, and
+// refuses a binding whose Thumbprint was changed since. IssueRefreshToken records Thumbprint for reference only, so
 // it accepts any binding of the client's registered kind.
 type TokenBinding struct {
 	// Thumbprint is the credential's thumbprint, as
@@ -94,9 +96,11 @@ type TokenBinding struct {
 	NextDPoPNonce string
 
 	// verifiedFor is the client VerifyTokenRequestBinding verified the
-	// credential for. Unexported, so only a binding it returned carries
-	// one: see IssueAccessToken.
-	verifiedFor fapi.ClientID
+	// credential for, and verifiedThumbprint the Thumbprint it verified.
+	// Unexported, so only a binding it returned carries them, and an
+	// edit to Thumbprint shows: see IssueAccessToken.
+	verifiedFor        fapi.ClientID
+	verifiedThumbprint string
 }
 
 // VerifyTokenRequestBinding verifies req's sender-constraining
@@ -144,7 +148,7 @@ func (s *Server) verifyExtensionGrantBinding(ctx context.Context, client storage
 	if err != nil {
 		return TokenBinding{}, err
 	}
-	return TokenBinding{Thumbprint: thumbprint, SenderConstrain: client.SenderConstrain(), NextDPoPNonce: nextNonce, verifiedFor: client.ID()}, nil
+	return TokenBinding{Thumbprint: thumbprint, SenderConstrain: client.SenderConstrain(), NextDPoPNonce: nextNonce, verifiedFor: client.ID(), verifiedThumbprint: thumbprint}, nil
 }
 
 // DPoPProofBinding is what VerifyTokenRequestDPoP verified: the DPoP key
diff --git a/server/par.go b/server/par.go
index 922cccad..c345e4df 100644
--- a/server/par.go
+++ b/server/par.go
@@ -348,7 +348,8 @@ func (s *Server) validateAuthorizationRequest(ctx context.Context, params map[st
 // method in each request", so a request carrying both attestation
 // headers and a client_assertion/client_assertion_type is refused with
 // invalid_request rather than authenticated by whichever one is checked
-// first. A peer certificate alone is not a second method: an mTLS
+// first. Draft-12 §7.6's use of an attestation as an additional signal
+// beside another method is not supported. A peer certificate alone is not a second method: an mTLS
 // connection presents one on every request, including a
 // private_key_jwt or attestation client's in an mTLS-sender-constrained
 // deployment, and it authenticates the client only when neither of the
@@ -359,7 +360,7 @@ func (s *Server) authenticateClient(ctx context.Context, params map[string]strin
 	switch {
 	case carriesAttestation && carriesAssertion:
 		return storage.RegisteredClient{}, clientassertion.VerifiedAssertion{},
-			newError(ErrorInvalidRequest, 400, "the request uses more than one client authentication method", nil)
+			newError(ErrorInvalidRequest, 400, "a client attestation cannot be combined with another client authentication method", nil)
 	case carriesAttestation:
 		return s.authenticateClientViaAttestation(ctx, params["client_id"], attestation, attestationPoP)
 	case params["client_assertion"] != "":
diff --git a/server/resource_indicators.go b/server/resource_indicators.go
index 421ed44d..c3e21e02 100644
--- a/server/resource_indicators.go
+++ b/server/resource_indicators.go
@@ -77,17 +77,22 @@ func (s *Server) resourceIndicatorsEnabled() bool {
 // takeResourceParameters splits a form request's "resource" parameters
 // (RFC 8707 §2: repeatable) from the rest, which then go through the
 // usual duplicate-refusing parsing. With resource indicators disabled
-// it returns params unchanged, so "resource" stays an ordinary,
-// ignored parameter.
+// it drops them, however many there are: "resource" is then a
+// parameter this server doesn't recognize, which RFC 6749 §3.1 and
+// §3.2 have it ignore, and a client following RFC 8707 may repeat it.
 func (s *Server) takeResourceParameters(params []FormParameter) ([]FormParameter, []string) {
+	rest, resources := splitResourceParameters(params)
 	if !s.resourceIndicatorsEnabled() {
-		return params, nil
+		return rest, nil
 	}
-	return splitResourceParameters(params)
+	return rest, resources
 }
 
 // splitResourceParameters separates params' "resource" parameters from
-// the rest. Too many parameters are returned unsplit, for
+// the rest, dropping any without a value: RFC 6749 §3.1 and §3.2,
+// "Parameters sent without a value MUST be treated as if they were
+// omitted from the request", so "resource=" is no resource, even beside
+// others. Too many parameters are returned unsplit, for
 // formParametersToMap to refuse, so the resources don't escape its
 // bound.
 func splitResourceParameters(params []FormParameter) ([]FormParameter, []string) {
@@ -97,11 +102,11 @@ func splitResourceParameters(params []FormParameter) ([]FormParameter, []string)
 	rest := make([]FormParameter, 0, len(params))
 	var resources []string
 	for _, p := range params {
-		if p.Name == resourceParameter {
+		if p.Name != resourceParameter {
+			rest = append(rest, p)
+		} else if p.Value != "" {
 			resources = append(resources, p.Value)
-			continue
 		}
-		rest = append(rest, p)
 	}
 	return rest, resources
 }
diff --git a/server/resource_indicators_fuzz_test.go b/server/resource_indicators_fuzz_test.go
index d9b54bbf..cd5f6e39 100644
--- a/server/resource_indicators_fuzz_test.go
+++ b/server/resource_indicators_fuzz_test.go
@@ -85,8 +85,9 @@ func checkAcceptedResources(t *testing.T, raw []byte, accepted []string) {
 // FuzzSplitResourceParameters runs an arbitrary form body through
 // FormRequestFromHTTP and takeResourceParameters, with resource
 // indicators enabled, as every endpoint taking "resource" does. RFC 8707
-// lets "resource" repeat, and nothing else: every resource value must
-// come out, in order and unchanged, while a repeat of any other
+// lets "resource" repeat, and nothing else: every resource value but
+// an empty one (RFC 6749 §3.2: omitted) must come out, in order and
+// unchanged, while a repeat of any other
 // parameter is still refused by formParametersToMap, which also still
 // bounds the request.
 func FuzzSplitResourceParameters(f *testing.F) {
@@ -115,8 +116,8 @@ func FuzzSplitResourceParameters(f *testing.F) {
 
 // checkResourceSplit fails t unless takeResourceParameters splits params
 // as RFC 8707 allows: over maxFormParameters, not at all (and
-// formParametersToMap refuses them); otherwise every resource value out,
-// in order, and the rest unchanged, with a repeat of any of those still
+// formParametersToMap refuses them); otherwise every non-empty resource
+// value out, in order, and the rest unchanged, with a repeat of any of those still
 // refused by formParametersToMap.
 func checkResourceSplit(t *testing.T, s *Server, params []FormParameter) {
 	t.Helper()
@@ -132,6 +133,8 @@ func checkResourceSplit(t *testing.T, s *Server, params []FormParameter) {
 	}
 
 	wantRest, wantResources := splitByName(params, resourceParameter)
+	// An empty value is no resource at all (RFC 6749 §3.1, §3.2).
+	wantResources = slices.DeleteFunc(wantResources, func(v string) bool { return v == "" })
 	if !slices.Equal(resources, wantResources) {
 		t.Fatalf("resources = %q, want %q", resources, wantResources)
 	}
diff --git a/server/resource_indicators_test.go b/server/resource_indicators_test.go
index 227116d4..f0cc992f 100644
--- a/server/resource_indicators_test.go
+++ b/server/resource_indicators_test.go
@@ -216,9 +216,34 @@ func TestResourceIndicatorsIgnoredWhenNothingConfigured(t *testing.T) {
 	}
 	wantAudience(t, result, testIssuer)
 
-	// "resource" stays an ordinary parameter: not repeatable.
-	_, err = pushWithResources(t, h, resourceA, resourceB)
-	wantErrorCode(t, err, server.ErrorInvalidRequest)
+	// Ignored however many times it's sent (RFC 6749 §3.1: an
+	// unrecognized parameter is ignored; RFC 8707 §2: it's repeatable).
+	code = grantForResources(t, h, resourceA, resourceB)
+	result, err = exchangeWithResources(t, h, code, resourceA, resourceB, "")
+	if err != nil {
+		t.Fatalf("ExchangeAuthorizationCode with repeated resources: %v", err)
+	}
+	wantAudience(t, result, testIssuer)
+}
+
+// TestResourceIndicatorsEmptyTreatedAsOmitted covers RFC 6749 §3.1 and
+// §3.2, "Parameters sent without a value MUST be treated as if they
+// were omitted from the request": an empty "resource" at PAR or the
+// token endpoint, alone or beside others, names no resource.
+func TestResourceIndicatorsEmptyTreatedAsOmitted(t *testing.T) {
+	h := withResources(t, newHarness(t, server.ProfileFAPISecurity, true), []string{resourceA, resourceB}, nil)
+
+	result, err := exchangeWithResources(t, h, grantForResources(t, h, ""), "")
+	if err != nil {
+		t.Fatalf("empty resource at PAR and the token endpoint: %v", err)
+	}
+	wantAudience(t, result, testIssuer)
+
+	result, err = exchangeWithResources(t, h, grantForResources(t, h, "", resourceA, ""), resourceA, "")
+	if err != nil {
+		t.Fatalf("empty resources beside one: %v", err)
+	}
+	wantAudience(t, result, resourceA)
 }
 
 func TestResourceIndicatorsPARValidation(t *testing.T) {
@@ -226,15 +251,16 @@ func TestResourceIndicatorsPARValidation(t *testing.T) {
 		resources []string
 		want      server.ErrorCode
 	}{
-		"one listed":         {resources: []string{resourceA}},
-		"two listed":         {resources: []string{resourceA, resourceB}},
-		"repeated":           {resources: []string{resourceA, resourceA}},
-		"unlisted":           {resources: []string{resourceA, resourceC}, want: server.ErrorInvalidTarget},
-		"relative":           {resources: []string{"/api"}, want: server.ErrorInvalidTarget},
-		"fragment":           {resources: []string{resourceA + "#x"}, want: server.ErrorInvalidTarget},
-		"empty":              {resources: []string{""}, want: server.ErrorInvalidTarget},
-		"too many":           {resources: manyResources(17), want: server.ErrorInvalidTarget},
-		"listed with prefix": {resources: []string{resourceA + "/"}, want: server.ErrorInvalidTarget},
+		"one listed":          {resources: []string{resourceA}},
+		"two listed":          {resources: []string{resourceA, resourceB}},
+		"repeated":            {resources: []string{resourceA, resourceA}},
+		"unlisted":            {resources: []string{resourceA, resourceC}, want: server.ErrorInvalidTarget},
+		"relative":            {resources: []string{"/api"}, want: server.ErrorInvalidTarget},
+		"fragment":            {resources: []string{resourceA + "#x"}, want: server.ErrorInvalidTarget},
+		"empty":               {resources: []string{""}},
+		"empty beside listed": {resources: []string{"", resourceA, ""}},
+		"too many":            {resources: manyResources(17), want: server.ErrorInvalidTarget},
+		"listed with prefix":  {resources: []string{resourceA + "/"}, want: server.ErrorInvalidTarget},
 	} {
 		t.Run(name, func(t *testing.T) {
 			h := withResources(t, newHarness(t, server.ProfileFAPISecurity, true), []string{resourceA, resourceB}, nil)