fix: terminate VaultGate connection after vault lockout

Merge pull request 'security: batch of fixes' (#95 ) from zeroized-bootstrap-token into main
Reviewed-on: #95
2026-06-30 20:07:01 +02:00 · 2026-06-29 18:00:14 +00:00 · 2026-06-28 12:06:06 +02:00 · 2026-06-27 13:25:27 +02:00 · 2026-06-25 20:09:18 +02:00 · 2026-06-22 17:53:34 +02:00
28 changed files with 820 additions and 407 deletions
--- a/protobufs/operator/vault/unseal.proto
+++ b/protobufs/operator/vault/unseal.proto
@@ -20,6 +20,7 @@ enum UnsealResult {
  UNSEAL_RESULT_SUCCESS = 1;
  UNSEAL_RESULT_INVALID_KEY = 2;
  UNSEAL_RESULT_UNBOOTSTRAPPED = 3;
+  UNSEAL_RESULT_LOCKED_OUT = 4;
 }

 message Request {
--- a/server/Cargo.lock
+++ b/server/Cargo.lock
@@ -44,9 +44,9 @@ checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"

 [[package]]
 name = "alloy"
-version = "2.1.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1172e33a862030da77768c11cf17a1f801590de94cf518392b65207f15810c8"
+checksum = "d8010fc7e9e8643ef4e758cdccf3eef26734594aedf88a9d5ed35e51837d42ef"
 dependencies = [
 "alloy-consensus",
 "alloy-contract",
@@ -78,9 +78,9 @@ dependencies = [

 [[package]]
 name = "alloy-consensus"
-version = "2.1.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b44937ce84d2cbf1ee4010667bd9214bb7db134a91dd9ffa6b1b8b1d6b030449"
+checksum = "e3d64da86c616b5092ea64eea648f311bbd58630a0b384c42d699175d6f9122b"
 dependencies = [
 "alloy-eips",
 "alloy-primitives",
@@ -96,7 +96,7 @@ dependencies = [
 "k256",
 "once_cell",
 "rand 0.8.6",
- "secp256k1 0.30.0",
+ "secp256k1",
 "serde",
 "serde_json",
 "serde_with",
@@ -105,9 +105,9 @@ dependencies = [

 [[package]]
 name = "alloy-consensus-any"
-version = "2.1.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7bb0bdd61ddff726026676450e7e6a52c68aa39d98f2d60d05ad7caaea5b8100"
+checksum = "8fd98696ca3617d3a9ba1a6f2011880cbfd5618228dab6400c9f8bca457859a8"
 dependencies = [
 "alloy-consensus",
 "alloy-eips",
@@ -119,9 +119,9 @@ dependencies = [

 [[package]]
 name = "alloy-contract"
-version = "2.1.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1475c7edc6780b1759ccdb7960e28d29856ecbed47cfcf9e25be6a5f48b0cfb"
+checksum = "de3df0aadc569a8b277808a7d0ad0e421180654ea36a3c59e9ed2bb968c9a1cd"
 dependencies = [
 "alloy-consensus",
 "alloy-dyn-abi",
@@ -142,9 +142,9 @@ dependencies = [

 [[package]]
 name = "alloy-core"
-version = "1.6.0"
+version = "1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62ddde5968de6044d67af107ad835bc0069a7ca245870b94c5958a7d8712b184"
+checksum = "23e8604b0c092fabc80d075ede181c9b9e596249c70b99253082d7e689836529"
 dependencies = [
 "alloy-dyn-abi",
 "alloy-json-abi",
@@ -155,9 +155,9 @@ dependencies = [

 [[package]]
 name = "alloy-dyn-abi"
-version = "1.6.0"
+version = "1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a475bb02d9cef2dbb99065c1664ab3fe1f9352e21d6d5ed3f02cdbfc06ed1abc"
+checksum = "cc2db5c583aaef0255aa63a4fe827f826090142528bba48d1bf4119b62780cad"
 dependencies = [
 "alloy-json-abi",
 "alloy-primitives",
@@ -166,7 +166,7 @@ dependencies = [
 "itoa",
 "serde",
 "serde_json",
- "winnow 1.0.2",
+ "winnow 0.7.15",
 ]

 [[package]]
@@ -209,23 +209,22 @@ dependencies = [

 [[package]]
 name = "alloy-eip7928"
-version = "0.4.5"
+version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3b12337f74cbfa451cb04dac173974814a6ff463079e1793aa09600ba8813ab"
+checksum = "ec6ae911a2fc304a7cb80a79fb7bed6d1474aed4e7c203df1f8ff538f64fc78d"
 dependencies = [
 "alloy-primitives",
 "alloy-rlp",
 "borsh",
 "once_cell",
 "serde",
- "thiserror",
 ]

 [[package]]
 name = "alloy-eips"
-version = "2.1.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "154b0f566ebbfc256b63c8d643c6a299f40a6fcd50a9d756c1d191487dd06483"
+checksum = "64c0456f5f7a4497e9342d20f528e30f5288ddfa0d6a012bd5044afee46cd8a0"
 dependencies = [
 "alloy-eip2124",
 "alloy-eip2930",
@@ -246,9 +245,9 @@ dependencies = [

 [[package]]
 name = "alloy-genesis"
-version = "2.1.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0a930a68a6f0ac19231bc2f5f0bf13fad3a26fa7df2525354890c72366c2998"
+checksum = "a71ff8b55d2b8aa05259f474cae7dea0e4991724dc18936b81cb23ec492a0c2a"
 dependencies = [
 "alloy-eips",
 "alloy-primitives",
@@ -261,9 +260,9 @@ dependencies = [

 [[package]]
 name = "alloy-json-abi"
-version = "1.6.0"
+version = "1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c36c9d7f9021601b04bfef14a4b64849f6d73116a4e91e071d7fbfe10247901"
+checksum = "e9dbe713da0c737d9e5e387b0ba790eb98b14dd207fe53eef50e19a5a8ec3dac"
 dependencies = [
 "alloy-primitives",
 "alloy-sol-type-parser",
@@ -273,9 +272,9 @@ dependencies = [

 [[package]]
 name = "alloy-json-rpc"
-version = "2.1.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e92108767c8c95b5e521570e039e374e65198c4179a98d200412c083d6c26d5"
+checksum = "19e352478b756bad5d7203148e4b461861282ea2ded3da406ba24868b52cd098"
 dependencies = [
 "alloy-primitives",
 "alloy-sol-types",
@@ -288,9 +287,9 @@ dependencies = [

 [[package]]
 name = "alloy-network"
-version = "2.1.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4546c9fae2861d4159ee3b25c44ab3edb90f21b849e86cf2086cacb1d56d8ac"
+checksum = "ed08ae169869e08370ed121612e0d3dadac33d1a256e9f2465926b23f0bd7d95"
 dependencies = [
 "alloy-consensus",
 "alloy-consensus-any",
@@ -314,9 +313,9 @@ dependencies = [

 [[package]]
 name = "alloy-network-primitives"
-version = "2.1.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca2c325d5934445209c8d22fc67d27e2cf9fb79054b8154d9e522d6a4ee3a4f7"
+checksum = "02e6c7ad28afe348a9a9c5624b67ee5b3607b8de98d5816b3056ecdfa6fa2697"
 dependencies = [
 "alloy-consensus",
 "alloy-eips",
@@ -327,9 +326,9 @@ dependencies = [

 [[package]]
 name = "alloy-primitives"
-version = "1.6.0"
+version = "1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4885c1409b6936c4898e646ef58baf6ec54edaf6d8179f79df805a7b85b7cf3e"
+checksum = "de3b431b4e72cd8bd0ec7a50b4be18e73dab74de0dba180eef171055e5d5926e"
 dependencies = [
 "alloy-rlp",
 "bytes",
@@ -337,7 +336,7 @@ dependencies = [
 "const-hex",
 "derive_more",
 "foldhash 0.2.0",
- "hashbrown 0.17.0",
+ "hashbrown 0.16.1",
 "indexmap 2.14.0",
 "itoa",
 "k256",
@@ -348,16 +347,15 @@ dependencies = [
 "rapidhash",
 "ruint",
 "rustc-hash",
- "secp256k1 0.31.1",
 "serde",
- "sha3",
+ "sha3 0.10.9",
 ]

 [[package]]
 name = "alloy-provider"
-version = "2.1.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff4536d25780fcf51a338c26153c526c99649be1273600684ef10b397a207d4a"
+checksum = "93a7c17472b55482d4734154c2f5ed13f72e03f6752cebb927f6a2d8b52e646c"
 dependencies = [
 "alloy-chains",
 "alloy-consensus",
@@ -416,9 +414,9 @@ dependencies = [

 [[package]]
 name = "alloy-rpc-client"
-version = "2.1.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f8d765656f02f993fa0565abeb3554ccd6a0d72ea44ce0558b983136639bd6b"
+checksum = "5beb5c2fe6b960c8e8b038e69fd502a90a2e930afa4770efb748b163b0767729"
 dependencies = [
 "alloy-json-rpc",
 "alloy-primitives",
@@ -439,9 +437,9 @@ dependencies = [

 [[package]]
 name = "alloy-rpc-types"
-version = "2.1.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a05ef5b11fad72068e6f011c21445bc5b596ac850644c4a14c30d845ce56de8"
+checksum = "4ee1257a278f6d293e05c5162c5940a1561b1aa85ded0028b464c81de37ebfa5"
 dependencies = [
 "alloy-primitives",
 "alloy-rpc-types-eth",
@@ -451,9 +449,9 @@ dependencies = [

 [[package]]
 name = "alloy-rpc-types-any"
-version = "2.1.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b06bfe79149dd53de5b196aa3c96db0500b7cf0ed72dbd1a31bac7660bc7cc65"
+checksum = "6a234bfbdf7a76c3d13808f729af5321852de3dedcaa6fc6d5f54787aaf54c6a"
 dependencies = [
 "alloy-consensus-any",
 "alloy-network-primitives",
@@ -466,9 +464,9 @@ dependencies = [

 [[package]]
 name = "alloy-rpc-types-eth"
-version = "2.1.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b41d1a11f58b456c199e04591befc64cb236fa2574a7275a07b98b173727bd39"
+checksum = "56a282daf869eeb7383d3d5c2deb35b0b3fb45ecb329513af4090fc61245ee18"
 dependencies = [
 "alloy-consensus",
 "alloy-consensus-any",
@@ -487,9 +485,9 @@ dependencies = [

 [[package]]
 name = "alloy-serde"
-version = "2.1.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcf028ac8bcb161ad7c104243e710cece8e1a794f65ee6c35c4c4d693c8e80ee"
+checksum = "a0eada2558e921b39dfcead33c487364df9b31374f5733c1c9d2c891c4529933"
 dependencies = [
 "alloy-primitives",
 "serde",
@@ -498,9 +496,9 @@ dependencies = [

 [[package]]
 name = "alloy-signer"
-version = "2.1.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a5f392f2f56b2417ea6b74e1e116c6f35df5ab5fce4dc422e277d72ee18ff7b"
+checksum = "41eb29f7a8adcd8941fbb8e134022a133e6f8dfd345f2e3b7109599f8a7dca08"
 dependencies = [
 "alloy-primitives",
 "async-trait",
@@ -513,9 +511,9 @@ dependencies = [

 [[package]]
 name = "alloy-signer-local"
-version = "2.1.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78de3d4ed62e2c90e16be166d0ddfe41944bb5979752703199073acf976083f2"
+checksum = "bef839e7ce9b59aa60fa9a175e97986c6145c888d643b0f1fb0a3e7b8e56a2e2"
 dependencies = [
 "alloy-consensus",
 "alloy-network",
@@ -529,9 +527,9 @@ dependencies = [

 [[package]]
 name = "alloy-sol-macro"
-version = "1.6.0"
+version = "1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "840128ed2b2971d6d4668a553fe403a82683d3acc646c73e75887e7157408033"
+checksum = "ab81bab693da9bb79f7a95b64b394718259fdd7e41dceeced4cad57cb71c4f6a"
 dependencies = [
 "alloy-sol-macro-expander",
 "alloy-sol-macro-input",
@@ -543,9 +541,9 @@ dependencies = [

 [[package]]
 name = "alloy-sol-macro-expander"
-version = "1.6.0"
+version = "1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63ec265e5d65d725175f6ca7711c970824c90ef9c0d1f1973711d4150ee612dd"
+checksum = "489f1620bb7e2483fb5819ed01ab6edc1d2f93939dce35a5695085a1afd1d699"
 dependencies = [
 "alloy-json-abi",
 "alloy-sol-macro-input",
@@ -555,16 +553,16 @@ dependencies = [
 "proc-macro-error2",
 "proc-macro2",
 "quote",
- "sha3",
+ "sha3 0.10.9",
 "syn 2.0.117",
 "syn-solidity",
 ]

 [[package]]
 name = "alloy-sol-macro-input"
-version = "1.6.0"
+version = "1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89bf01077f18650876cfa682eb1f949967b5cde03f1a51c955c469d2c9b4aa67"
+checksum = "56cef806ad22d4392c5fc83cf8f2089f988eb99c7067b4e0c6f1971fc1cca318"
 dependencies = [
 "alloy-json-abi",
 "const-hex",
@@ -580,19 +578,19 @@ dependencies = [

 [[package]]
 name = "alloy-sol-type-parser"
-version = "1.6.0"
+version = "1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "857b470ecdd2ed38beaf82ad1a38c516a8ff75266750f38b9eeed001d575241b"
+checksum = "a6df77fea9d6a2a75c0ef8d2acbdfd92286cc599983d3175ccdc170d3433d249"
 dependencies = [
 "serde",
- "winnow 1.0.2",
+ "winnow 0.7.15",
 ]

 [[package]]
 name = "alloy-sol-types"
-version = "1.6.0"
+version = "1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "384cf252de0db2dec52821eac037a7f57e2aa33fe5b900ce6fe39973402341f1"
+checksum = "64612d29379782a5dde6f4b6570d9c756d734d760c0c94c254d361e678a6591f"
 dependencies = [
 "alloy-json-abi",
 "alloy-primitives",
@@ -602,9 +600,9 @@ dependencies = [

 [[package]]
 name = "alloy-transport"
-version = "2.1.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39f42ee1ef30d4d3d8b4ea5794937fccfc69e2bb1cd5bcf42d62afc57b049081"
+checksum = "3ac7a80c0bac3e44559d53d002e34c461dc2f23262b42cafec019bc70551abbe"
 dependencies = [
 "alloy-json-rpc",
 "auto_impl",
@@ -625,9 +623,9 @@ dependencies = [

 [[package]]
 name = "alloy-transport-http"
-version = "2.1.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee68bc7d713e033eeaaecb8fd13d5d8a41af97226c4388930ad459285b8e9f70"
+checksum = "eed3ed3300a998f88639ed619fdbbd88bd82865e00c6a8ecb796c99eb12358f6"
 dependencies = [
 "alloy-json-rpc",
 "alloy-transport",
@@ -657,9 +655,9 @@ dependencies = [

 [[package]]
 name = "alloy-tx-macros"
-version = "2.1.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc2cd27809c88c413e5542dbd5a8eff8c12f0086af920e881ae586d3a787d5e5"
+checksum = "99fce0350197dcd4ba4e9a7dd43915d908c0eb0e7352755791709a705e1c76b6"
 dependencies = [
 "darling 0.23.0",
 "proc-macro2",
@@ -678,9 +676,9 @@ dependencies = [

 [[package]]
 name = "anyhow"
-version = "1.0.103"
+version = "1.0.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"

 [[package]]
 name = "arbiter-client"
@@ -773,6 +771,7 @@ dependencies = [
 "proptest",
 "prost-types",
 "rand 0.10.1",
+ "rand_core 0.10.1",
 "rcgen",
 "restructed",
 "rstest",
@@ -1227,7 +1226,7 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
 dependencies = [
- "bit-vec 0.8.0",
+ "bit-vec",
 ]

 [[package]]
@@ -1236,15 +1235,6 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"

-[[package]]
-name = "bit-vec"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "bitcoin-io"
 version = "0.1.4"
@@ -1445,9 +1435,9 @@ dependencies = [

 [[package]]
 name = "chrono"
-version = "0.4.45"
+version = "0.4.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
+checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
 dependencies = [
 "iana-time-zone",
 "js-sys",
@@ -1646,7 +1636,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77727bb15fa921304124b128af125e7e3b968275d1b108b379190264f4423710"
 dependencies = [
- "getrandom 0.4.2",
 "hybrid-array",
 "rand_core 0.10.1",
 ]
@@ -1871,9 +1860,9 @@ dependencies = [

 [[package]]
 name = "diesel"
-version = "2.3.10"
+version = "2.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29fe29a87fb84c631ffb3ba21798c4b1f3a964701ba78f0dce4bf8668562ec88"
+checksum = "9940fb8467a0a06312218ed384185cb8536aa10d8ec017d0ce7fad2c1bd882d5"
 dependencies = [
 "chrono",
 "diesel_derives",
@@ -1887,9 +1876,9 @@ dependencies = [

 [[package]]
 name = "diesel-async"
-version = "0.9.2"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd39af30158d444884f166fe4c58f35dc40ad71ad017bb59408a3448526ff4bd"
+checksum = "9c20ddcc6737cecdaef3dfecb2796bdfe3002456521189d30be8e4c5a1bc821d"
 dependencies = [
 "bb8",
 "diesel",
@@ -2448,6 +2437,8 @@ dependencies = [
 "allocator-api2",
 "equivalent",
 "foldhash 0.2.0",
+ "serde",
+ "serde_core",
 ]

 [[package]]
@@ -2455,11 +2446,6 @@ name = "hashbrown"
 version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
-dependencies = [
- "foldhash 0.2.0",
- "serde",
- "serde_core",
-]

 [[package]]
 name = "heck"
@@ -2508,9 +2494,9 @@ dependencies = [

 [[package]]
 name = "http"
-version = "1.4.2"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
+checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
 dependencies = [
 "bytes",
 "itoa",
@@ -3005,6 +2991,15 @@ dependencies = [
 "syn 2.0.117",
 ]

+[[package]]
+name = "keccak"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
+dependencies = [
+ "cpufeatures 0.2.17",
+]
+
 [[package]]
 name = "keccak"
 version = "0.2.0"
@@ -3128,9 +3123,9 @@ checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"

 [[package]]
 name = "macro-string"
-version = "0.2.0"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59a9dbbfc75d2688ed057456ce8a3ee3f48d12eec09229f560f3643b9f275653"
+checksum = "1b27834086c65ec3f9387b096d66e99f221cf081c2b738042aa252bcd41204e3"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -3255,18 +3250,18 @@ dependencies = [

 [[package]]
 name = "ml-dsa"
-version = "0.1.1"
+version = "0.1.0-rc.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "add6b9d92e496f16f4526d68ff29da1483aba4b119baeab8bed3b9e3544a6f3d"
+checksum = "e3a596bd65985e2b343c3fd6cc4ade15cdd76da66b15936cfbce72ea661cdbb2"
 dependencies = [
 "const-oid 0.10.2",
- "crypto-common 0.2.1",
 "ctutils",
 "hybrid-array",
 "module-lattice",
 "pkcs8 0.11.0",
- "shake",
- "signature 3.0.0",
+ "rand_core 0.10.1",
+ "sha3 0.11.0",
+ "signature 3.0.0-rc.10",
 "zeroize",
 ]

@@ -3280,15 +3275,15 @@ dependencies = [
 "kem",
 "module-lattice",
 "rand_core 0.10.1",
- "sha3",
+ "sha3 0.11.0",
 "zeroize",
 ]

 [[package]]
 name = "module-lattice"
-version = "0.2.3"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c61b87c9683ab7cb1c6871d261ad5479b6b10ceb52c4352aaca3b5d35a8febe"
+checksum = "dc7c90d33a0dac244570c26461d761ffaeadb3bfc2b17cc625ae2185cafdffae"
 dependencies = [
 "ctutils",
 "hybrid-array",
@@ -3745,7 +3740,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744"
 dependencies = [
 "bit-set",
- "bit-vec 0.8.0",
+ "bit-vec",
 "bitflags",
 "num-traits",
 "rand 0.9.4",
@@ -3759,9 +3754,9 @@ dependencies = [

 [[package]]
 name = "prost"
-version = "0.14.4"
+version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "528ac67416ff8646872a3c02cad9cc4ee5dc9f9540c9b10771855c95cb2e5ae1"
+checksum = "d2ea70524a2f82d518bce41317d0fae74151505651af45faf1ffbd6fd33f0568"
 dependencies = [
 "bytes",
 "prost-derive",
@@ -3790,9 +3785,9 @@ dependencies = [

 [[package]]
 name = "prost-derive"
-version = "0.14.4"
+version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
+checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
 dependencies = [
 "anyhow",
 "itertools 0.14.0",
@@ -3803,9 +3798,9 @@ dependencies = [

 [[package]]
 name = "prost-types"
-version = "0.14.4"
+version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f94967dc7688f3054c7fac87473ffae4cc4c3904800e2d9f5b857246d8963b0a"
+checksum = "8991c4cbdb8bc5b11f0b074ffe286c30e523de90fee5ba8132f1399f23cb3dd7"
 dependencies = [
 "chrono",
 "prost",
@@ -4019,9 +4014,9 @@ dependencies = [

 [[package]]
 name = "rcgen"
-version = "0.14.8"
+version = "0.14.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57f6d249aad744e274e682777a50283a225a32705394ee6d5fcc01efa25e4055"
+checksum = "10b99e0098aa4082912d4c649628623db6aba77335e4f4569ff5083a6448b32e"
 dependencies = [
 "aws-lc-rs",
 "pem",
@@ -4312,9 +4307,9 @@ dependencies = [

 [[package]]
 name = "rustls"
-version = "0.23.41"
+version = "0.23.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f"
+checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
 dependencies = [
 "aws-lc-rs",
 "log",
@@ -4475,21 +4470,10 @@ checksum = "b50c5943d326858130af85e049f2661ba3c78b26589b8ab98e65e80ae44a1252"
 dependencies = [
 "bitcoin_hashes",
 "rand 0.8.6",
- "secp256k1-sys 0.10.1",
+ "secp256k1-sys",
 "serde",
 ]

-[[package]]
-name = "secp256k1"
-version = "0.31.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c3c81b43dc2d8877c216a3fccf76677ee1ebccd429566d3e67447290d0c42b2"
-dependencies = [
- "bitcoin_hashes",
- "rand 0.9.4",
- "secp256k1-sys 0.11.0",
-]
-
 [[package]]
 name = "secp256k1-sys"
 version = "0.10.1"
@@ -4499,15 +4483,6 @@ dependencies = [
 "cc",
 ]

-[[package]]
-name = "secp256k1-sys"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcb913707158fadaf0d8702c2db0e857de66eb003ccfdda5924b5f5ac98efb38"
-dependencies = [
- "cc",
-]
-
 [[package]]
 name = "security-framework"
 version = "3.7.0"
@@ -4670,6 +4645,16 @@ dependencies = [
 "digest 0.11.2",
 ]

+[[package]]
+name = "sha3"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874"
+dependencies = [
+ "digest 0.10.7",
+ "keccak 0.1.6",
+]
+
 [[package]]
 name = "sha3"
 version = "0.11.0"
@@ -4677,7 +4662,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be176f1a57ce4e3d31c1a166222d9768de5954f811601fb7ca06fc8203905ce1"
 dependencies = [
 "digest 0.11.2",
- "keccak",
+ "keccak 0.2.0",
 ]

 [[package]]
@@ -4690,17 +4675,6 @@ dependencies = [
 "cfg-if",
 ]

-[[package]]
-name = "shake"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09057cb2149ad4cbd2da1e26b351f9a4c354219421229c69c3063e6f61947c4a"
-dependencies = [
- "digest 0.11.2",
- "keccak",
- "sponge-cursor",
-]
-
 [[package]]
 name = "sharded-slab"
 version = "0.1.7"
@@ -4738,9 +4712,9 @@ dependencies = [

 [[package]]
 name = "signature"
-version = "3.0.0"
+version = "3.0.0-rc.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5"
+checksum = "7f1880df446116126965eeec169136b2e0251dba37c6223bcc819569550edea3"
 dependencies = [
 "digest 0.11.2",
 "rand_core 0.10.1",
@@ -4834,12 +4808,6 @@ dependencies = [
 "der 0.8.0",
 ]

-[[package]]
-name = "sponge-cursor"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a0219bd7d979d58245a4f41f695e1ac9f8befdffadd7f61f1bae9e39abc6620"
-
 [[package]]
 name = "sqlite-wasm-rs"
 version = "0.5.3"
@@ -4969,9 +4937,9 @@ dependencies = [

 [[package]]
 name = "syn-solidity"
-version = "1.6.0"
+version = "1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec005042c7d952febc1a3ef5b0f6674e9054aa836877a31c90b20e25b3d31744"
+checksum = "53f425ae0b12e2f5ae65542e00898d500d4d318b4baf09f40fd0d410454e9947"
 dependencies = [
 "paste",
 "proc-macro2",
@@ -5165,9 +5133,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"

 [[package]]
 name = "tokio"
-version = "1.52.3"
+version = "1.52.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
+checksum = "b67dee974fe86fd92cc45b7a95fdd2f99a36a6d7b0d431a231178d3d670bbcc6"
 dependencies = [
 "bytes",
 "libc",
@@ -5281,9 +5249,9 @@ dependencies = [

 [[package]]
 name = "tonic"
-version = "0.14.6"
+version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac2a5518c70fa84342385732db33fb3f44bc4cc748936eb5833d2df34d6445ef"
+checksum = "fec7c61a0695dc1887c1b53952990f3ad2e3a31453e1f49f10e75424943a93ec"
 dependencies = [
 "async-trait",
 "axum",
@@ -5313,9 +5281,9 @@ dependencies = [

 [[package]]
 name = "tonic-build"
-version = "0.14.6"
+version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c68f61875ac5293cf72e6c8cf0158086428c82c37229e98c840878f1706b0322"
+checksum = "1882ac3bf5ef12877d7ed57aad87e75154c11931c2ba7e6cde5e22d63522c734"
 dependencies = [
 "prettyplease",
 "proc-macro2",
@@ -5325,9 +5293,9 @@ dependencies = [

 [[package]]
 name = "tonic-prost"
-version = "0.14.6"
+version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50849f68853be452acf590cde0b146665b8d507b3b8af17261df47e02c209ea0"
+checksum = "a55376a0bbaa4975a3f10d009ad763d8f4108f067c7c2e74f3001fb49778d309"
 dependencies = [
 "bytes",
 "prost",
@@ -5336,9 +5304,9 @@ dependencies = [

 [[package]]
 name = "tonic-prost-build"
-version = "0.14.6"
+version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "654e5643eff75d7f8c99197ce1440ed19a3474eada74c12bbac488b2cafdae27"
+checksum = "f3144df636917574672e93d0f56d7edec49f90305749c668df5101751bb8f95a"
 dependencies = [
 "prettyplease",
 "proc-macro2",
@@ -6042,6 +6010,9 @@ name = "winnow"
 version = "0.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
+dependencies = [
+ "memchr",
+]

 [[package]]
 name = "winnow"
@@ -6170,7 +6141,7 @@ dependencies = [
 "kem",
 "ml-kem",
 "rand_core 0.10.1",
- "sha3",
+ "sha3 0.11.0",
 "x25519-dalek 3.0.0-pre.6",
 "zeroize",
 ]
@@ -6218,11 +6189,10 @@ dependencies = [

 [[package]]
 name = "yasna"
-version = "0.6.0"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5f6765e852b9b4dc8e2a76843e4d64d1cea8e79bcde0b6901aea8e7c7f08282"
+checksum = "e17bb3549cc1321ae1296b9cdc2698e2b6cb1992adfa19a8c72e5b7a738f44cd"
 dependencies = [
- "bit-vec 0.9.1",
 "time",
 ]

@@ -6292,18 +6262,18 @@ dependencies = [

 [[package]]
 name = "zeroize"
-version = "1.8.2"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
 dependencies = [
 "zeroize_derive",
 ]

 [[package]]
 name = "zeroize_derive"
-version = "1.4.3"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85a5b4158499876c763cb03bc4e49185d3cccbabb15b33c627f7884f43db852e"
+checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328"
 dependencies = [
 "proc-macro2",
 "quote",
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -6,31 +6,32 @@ resolver = "3"


 [workspace.dependencies]
-alloy = "2.1.0"
+alloy = "2.0.4"
 async-trait = "0.1.89"
 base64 = "0.22.1"
-chrono = { version = "0.4.45", features = ["serde"] }
+chrono = { version = "0.4.44", features = ["serde"] }
 futures = "0.3.32"
 k256 = { version = "0.13.4", features = ["ecdsa", "pkcs8"] }
 kameo = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
 kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
 hmac = "0.13.0"
 miette = { version = "7.6.0", features = ["fancy", "serde"] }
-ml-dsa = { version = "0.1.1", features = ["zeroize"] }
+ml-dsa = { version = "0.1.0-rc.9", features = ["zeroize"] }
 mutants = "0.0.4"
-prost = "0.14.4"
-prost-types = { version = "0.14.4", features = ["chrono"] }
+prost = "0.14.3"
+prost-types = { version = "0.14.3", features = ["chrono"] }
 rand = "0.10.1"
-rcgen = { version = "0.14.8", features = [ "aws_lc_rs",  "pem", "x509-parser", "zeroize" ], default-features = false }
+rand_core = "0.10.1"
+rcgen = { version = "0.14.7", features = [ "aws_lc_rs",  "pem", "x509-parser", "zeroize" ], default-features = false }
 rstest = "0.26.1"
-rustls = { version = "0.23.41", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
+rustls = { version = "0.23.40", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
 rustls-pki-types = "1.14.1"
 sha2 = "0.11"
 smlang = "0.8.0"
 thiserror = "2.0.18"
-tokio = { version = "1.52.3", features = ["full"] }
+tokio = { version = "1.52.1", features = ["full"] }
 tokio-stream = { version = "0.1.18", features = ["full"] }
-tonic = { version = "0.14.6", features = [ "deflate", "gzip", "tls-connect-info", "zstd" ] }
+tonic = { version = "0.14.5", features = [ "deflate", "gzip", "tls-connect-info", "zstd" ] }
 tracing = "0.1.44"
 x25519-dalek = { version = "2.0.1", features = ["getrandom"] }

--- a/server/crates/arbiter-client/Cargo.toml
+++ b/server/crates/arbiter-client/Cargo.toml
@@ -20,7 +20,7 @@ tonic.features = ["tls-aws-lc"]
 tokio.workspace = true
 tokio-stream.workspace = true
 thiserror.workspace = true
-http = "1.4.2"
+http = "1.4.0"
 rustls-webpki = { version = "0.103.13", features = ["aws-lc-rs"] }
 async-trait.workspace = true
 chrono.workspace = true
--- a/server/crates/arbiter-crypto/src/authn/v1.rs
+++ b/server/crates/arbiter-crypto/src/authn/v1.rs
@@ -1,8 +1,8 @@
 use chrono::{DateTime, Utc};
 use hmac::digest::Digest;
 use ml_dsa::{
-    EncodedVerifyingKey, Error, ExpandedSigningKey, Generate, MlDsa87, Seed,
-    Signature as MlDsaSignature, SigningKey as MlDsaSigningKey, VerifyingKey as MlDsaVerifyingKey,
+    EncodedVerifyingKey, Error, KeyGen, MlDsa87, Seed, Signature as MlDsaSignature,
+    SigningKey as MlDsaSigningKey, VerifyingKey as MlDsaVerifyingKey, signature::Keypair as _,
 };
 use rand::RngExt;

@@ -77,10 +77,7 @@ impl crate::hashing::Hashable for PublicKey {
 pub struct Signature(Box<MlDsaSignature<KeyParams>>);

 #[derive(Debug)]
-pub struct SigningKey {
-    key: Box<ExpandedSigningKey<KeyParams>>,
-    seed: Seed,
-}
+pub struct SigningKey(Box<MlDsaSigningKey<KeyParams>>);

 impl PublicKey {
    pub fn to_bytes(&self) -> Vec<u8> {
@@ -103,31 +100,24 @@ impl Signature {

 impl SigningKey {
    pub fn generate() -> Self {
-        let seed = MlDsaSigningKey::<KeyParams>::generate_from_rng(&mut rand::rng()).to_seed();
-        Self {
-            key: Box::new(ExpandedSigningKey::from_seed(&seed)),
-            seed,
-        }
+        Self(Box::new(KeyParams::key_gen(&mut rand::rng())))
    }

    pub fn from_seed(seed: [u8; 32]) -> Self {
-        let seed = Seed::from(seed);
-        Self {
-            key: Box::new(ExpandedSigningKey::from_seed(&seed)),
-            seed,
-        }
+        Self(Box::new(KeyParams::from_seed(&Seed::from(seed))))
    }

    pub fn to_seed(&self) -> [u8; 32] {
-        self.seed.into()
+        self.0.to_seed().into()
    }

    pub fn public_key(&self) -> PublicKey {
-        self.key.verifying_key().into()
+        self.0.verifying_key().into()
    }

    pub fn sign_message(&self, message: &[u8], context: &[u8]) -> Result<Signature, Error> {
-        self.key
+        self.0
+            .signing_key()
            .sign_deterministic(message, context)
            .map(Into::into)
    }
@@ -155,6 +145,12 @@ impl From<MlDsaSignature<KeyParams>> for Signature {
    }
 }

+impl From<MlDsaSigningKey<KeyParams>> for SigningKey {
+    fn from(value: MlDsaSigningKey<KeyParams>) -> Self {
+        Self(Box::new(value))
+    }
+}
+
 impl TryFrom<Vec<u8>> for PublicKey {
    type Error = ();

@@ -192,15 +188,15 @@ impl TryFrom<&'_ [u8]> for Signature {

 #[cfg(test)]
 mod tests {
-    use ml_dsa::{Generate as _, MlDsa87, SigningKey as RealSigningKey, signature::Keypair as _};
+    use ml_dsa::{KeyGen, MlDsa87, signature::Keypair as _};

    use crate::authn::AuthChallenge;

-    use super::{CLIENT_CONTEXT, OPERATOR_CONTEXT, PublicKey, Signature, SigningKey};
+    use super::{CLIENT_CONTEXT, PublicKey, Signature, SigningKey, OPERATOR_CONTEXT};

    #[test]
    fn public_key_round_trip_decodes() {
-        let key = RealSigningKey::<MlDsa87>::generate();
+        let key = MlDsa87::key_gen(&mut rand::rng());
        let encoded = PublicKey::from(key.verifying_key()).to_bytes();

        let decoded = PublicKey::try_from(encoded.as_slice()).expect("public key should decode");
--- a/server/crates/arbiter-proto/Cargo.toml
+++ b/server/crates/arbiter-proto/Cargo.toml
@@ -9,7 +9,7 @@ license = "Apache-2.0"
 tonic.workspace = true
 tokio.workspace = true
 futures.workspace = true
-tonic-prost = "0.14.6"
+tonic-prost = "0.14.5"
 prost.workspace = true
 kameo.workspace = true
 url = "2.5.8"
@@ -22,7 +22,7 @@ async-trait.workspace = true
 tokio-stream.workspace = true

 [build-dependencies]
-tonic-prost-build = "0.14.6"
+tonic-prost-build = "0.14.5"

 [dev-dependencies]
 rstest.workspace = true
--- a/server/crates/arbiter-server/Cargo.toml
+++ b/server/crates/arbiter-server/Cargo.toml
@@ -9,8 +9,8 @@ license = "Apache-2.0"
 workspace = true

 [dependencies]
-diesel = { version = "2.3.10", features = ["chrono", "returning_clauses_for_sqlite_3_35", "serde_json", "time", "uuid"] }
-diesel-async = { version = "0.9.2", features = [
+diesel = { version = "2.3.9", features = ["chrono", "returning_clauses_for_sqlite_3_35", "serde_json", "time", "uuid"] }
+diesel-async = { version = "0.9.0", features = [
    "bb8",
    "migrations",
    "sqlite",
@@ -31,6 +31,7 @@ diesel_migrations = { version = "2.3.2", features = ["sqlite"] }
 async-trait.workspace = true
 tokio-stream.workspace = true
 rand.workspace = true
+rand_core.workspace = true
 rcgen.workspace = true
 chrono.workspace = true
 kameo.workspace = true
@@ -44,7 +45,7 @@ hmac.workspace = true
 alloy.workspace = true
 prost-types.workspace = true
 arbiter-tokens-registry.path = "../arbiter-tokens-registry"
-anyhow = "1.0.103"
+anyhow = "1.0.102"
 mutants.workspace = true
 subtle = "2.6.1"
 x25519-dalek.workspace = true
--- a/server/crates/arbiter-server/src/actors/bootstrap.rs
+++ b/server/crates/arbiter-server/src/actors/bootstrap.rs
@@ -1,29 +1,48 @@
 use crate::db::{self, DatabasePool, schema};
+use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
 use arbiter_proto::{BOOTSTRAP_PATH, home_path};

 use diesel::QueryDsl;
 use diesel_async::RunQueryDsl;
 use kameo::{Actor, messages};
-use rand::{RngExt, distr::Alphanumeric, make_rng, rngs::StdRng};
+use rand::{RngExt, distr::Alphanumeric, rngs::SysRng};
+use rand_core::UnwrapErr;
+use std::path::{Path, PathBuf};
 use subtle::ConstantTimeEq as _;
 use thiserror::Error;
+use tracing::warn;

 const TOKEN_LENGTH: usize = 64;

-pub async fn generate_token() -> Result<String, std::io::Error> {
-    let rng: StdRng = make_rng();
+async fn write_token_file(path: &Path, content: &str) -> Result<(), std::io::Error> {
+    tokio::fs::write(path, content.as_bytes()).await?;

-    let token = rng.sample_iter(Alphanumeric).take(TOKEN_LENGTH).fold(
-        String::default(),
-        |mut accum, char| {
-            accum += char.to_string().as_str();
-            accum
-        },
-    );
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt as _;
+        tokio::fs::set_permissions(path, std::fs::Permissions::from_mode(0o600)).await?;
+    }

-    tokio::fs::write(home_path()?.join(BOOTSTRAP_PATH), token.as_str()).await?;
+    Ok(())
+}

-    Ok(token)
+async fn generate_token(path: &Path) -> Result<SafeCell<[u8; TOKEN_LENGTH]>, std::io::Error> {
+    let mut cell = SafeCell::new([0u8; TOKEN_LENGTH]);
+    {
+        let mut buf = cell.write();
+        for (slot, b) in buf
+            .iter_mut()
+            .zip(UnwrapErr(SysRng).sample_iter(Alphanumeric))
+        {
+            *slot = b;
+        }
+    }
+
+    let token_str = cell.read_inline(|buf| String::from_utf8_lossy(buf.as_ref()).into_owned());
+
+    write_token_file(path, &token_str).await?;
+
+    Ok(cell)
 }

 #[derive(Error, Debug)]
@@ -40,7 +59,8 @@ pub enum Error {

 #[derive(Actor)]
 pub struct Bootstrapper {
-    token: Option<String>,
+    token: Option<SafeCell<[u8; TOKEN_LENGTH]>>,
+    token_path: Option<PathBuf>,
 }

 impl Bootstrapper {
@@ -54,34 +74,37 @@ impl Bootstrapper {
                .await?
        };

-        let token = if row_count == 0 {
-            let token = generate_token().await?;
-            Some(token)
+        let (token, token_path) = if row_count == 0 {
+            let path = home_path()?.join(BOOTSTRAP_PATH);
+            let token = generate_token(&path).await?;
+            (Some(token), Some(path))
        } else {
-            None
+            (None, None)
        };

-        Ok(Self { token })
+        Ok(Self { token, token_path })
+    }
+}
+
+impl Bootstrapper {
+    fn is_correct_token(&mut self, token: &[u8]) -> bool {
+        self.token.as_mut().is_some_and(|expected| {
+            expected.read_inline(|exp| bool::from(exp.as_ref().ct_eq(token)))
+        })
    }
 }

 #[messages]
 impl Bootstrapper {
    #[message]
-    pub fn is_correct_token(&self, token: String) -> bool {
-        self.token.as_ref().is_some_and(|expected| {
-            let expected_bytes = expected.as_bytes();
-            let token_bytes = token.as_bytes();
-
-            let choice = expected_bytes.ct_eq(token_bytes);
-            bool::from(choice)
-        })
-    }
-
-    #[message]
-    pub fn consume_token(&mut self, token: String) -> bool {
-        if self.is_correct_token(token) {
+    pub async fn consume_token(&mut self, token: Vec<u8>) -> bool {
+        if self.is_correct_token(&token) {
            self.token = None;
+            if let Some(path) = self.token_path.take()
+                && let Err(e) = tokio::fs::remove_file(&path).await
+            {
+                warn!(error = ?e, path = ?path, "Failed to delete bootstrap token file after consumption");
+            }
            true
        } else {
            false
@@ -92,7 +115,9 @@ impl Bootstrapper {
 #[messages]
 impl Bootstrapper {
    #[message]
-    pub fn get_token(&self) -> Option<String> {
-        self.token.clone()
+    pub fn get_token(&mut self) -> Option<String> {
+        self.token
+            .as_mut()
+            .map(|cell| cell.read_inline(|buf| String::from_utf8_lossy(buf.as_ref()).into_owned()))
    }
 }
--- a/server/crates/arbiter-server/src/actors/evm/mod.rs
+++ b/server/crates/arbiter-server/src/actors/evm/mod.rs
@@ -1,6 +1,6 @@
 use crate::{
    actors::vault::{CreateNew, Decrypt, Vault},
-    crypto::integrity,
+    crypto::integrity::{self, Integrable},
    db::{
        DatabaseError, DatabasePool,
        models::{self},
@@ -25,14 +25,35 @@ use diesel::{
 use diesel_async::RunQueryDsl;
 use kameo::{Actor, actor::ActorRef, messages};
 use rand::{SeedableRng, rng, rngs::StdRng};
+use tracing::error;

 pub use crate::evm::safe_signer;

+/// Integrity guard that binds a wallet's encrypted key ID to its Ethereum address.
+/// Both fields are included in the HMAC — swapping `aead_encrypted_id` in the DB
+/// invalidates the envelope MAC, and the AEAD ciphertext is also bound to `address`
+/// as AAD, so decryption fails too.
+#[derive(arbiter_macros::Hashable)]
+struct EvmWalletIntegrity {
+    aead_encrypted_id: i32,
+    address: Address,
+}
+
+impl Integrable for EvmWalletIntegrity {
+    const KIND: &'static str = "evm_wallet";
+}
+
 #[derive(Debug, thiserror::Error)]
 pub enum SignTransactionError {
    #[error("Wallet not found")]
    WalletNotFound,

+    #[error("Decrypted key does not match requested wallet address")]
+    KeyAddressMismatch,
+
+    #[error("Internal signing error")]
+    Internal,
+
    #[error("Database error: {0}")]
    Database(#[from] DatabaseError),

@@ -64,6 +85,12 @@ pub enum Error {
    Integrity(#[from] integrity::Error),
 }

+impl From<diesel::result::Error> for Error {
+    fn from(e: diesel::result::Error) -> Self {
+        Self::Database(DatabaseError::from(e))
+    }
+}
+
 #[derive(Actor)]
 pub struct EvmActor {
    pub vault: ActorRef<Vault>,
@@ -97,20 +124,39 @@ impl EvmActor {

        let aead_id: i32 = self
            .vault
-            .ask(CreateNew { plaintext })
+            .ask(CreateNew {
+                plaintext,
+                aad: address.as_slice().to_vec(),
+            })
            .await
            .map_err(|_| Error::VaultSend)?;

        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
-        let wallet_id = insert_into(schema::evm_wallet::table)
-            .values(&models::NewEvmWallet {
-                address: address.as_slice().to_vec(),
-                aead_encrypted_id: aead_id,
+        let wallet_id = conn
+            .exclusive_transaction(async |conn| {
+                let wallet_id: i32 = insert_into(schema::evm_wallet::table)
+                    .values(&models::NewEvmWallet {
+                        address: address.as_slice().to_vec(),
+                        aead_encrypted_id: aead_id,
+                    })
+                    .returning(schema::evm_wallet::id)
+                    .get_result(conn)
+                    .await
+                    .map_err(DatabaseError::from)
+                    .map_err(Error::Database)?;
+
+                integrity::sign_entity(
+                    conn,
+                    &self.vault,
+                    &EvmWalletIntegrity { address, aead_encrypted_id: aead_id },
+                    wallet_id,
+                )
+                .await
+                .map_err(Error::Integrity)?;
+
+                Ok::<i32, Error>(wallet_id)
            })
-            .returning(schema::evm_wallet::id)
-            .get_result(&mut conn)
-            .await
-            .map_err(DatabaseError::from)?;
+            .await?;

        Ok((wallet_id, address))
    }
@@ -241,16 +287,51 @@ impl EvmActor {
            .ok_or(SignTransactionError::WalletNotFound)?;
        drop(conn);

+        let mut conn = self.db.get().await.map_err(DatabaseError::from)?;
+        let attestation = integrity::verify_entity(
+            &mut conn,
+            &self.vault,
+            &EvmWalletIntegrity {
+                address: wallet_address,
+                aead_encrypted_id: wallet.aead_encrypted_id,
+            },
+            wallet.id,
+        )
+        .await
+        .map_err(|e| {
+            error!(?e, wallet_id = wallet.id, "EVM wallet integrity check failed");
+            SignTransactionError::Internal
+        })?;
+        drop(conn);
+
+        if attestation != integrity::AttestationStatus::Attested {
+            error!(
+                wallet_id = wallet.id,
+                "EVM wallet integrity unavailable; refusing to sign"
+            );
+            return Err(SignTransactionError::Internal);
+        }
+
        let raw_key: SafeCell<Vec<u8>> = self
            .vault
            .ask(Decrypt {
                aead_id: wallet.aead_encrypted_id,
+                aad: wallet.address.clone(),
            })
            .await
            .map_err(|_| SignTransactionError::VaultSend)?;

        let signer = safe_signer::SafeSigner::from_cell(raw_key)?;

+        if signer.address() != wallet_address {
+            error!(
+                expected = %wallet_address,
+                actual = %signer.address(),
+                "Decrypted private key address does not match requested wallet"
+            );
+            return Err(SignTransactionError::KeyAddressMismatch);
+        }
+
        self.engine
            .evaluate_transaction(wallet_access, transaction.clone(), RunKind::Execution)
            .await?;
--- a/server/crates/arbiter-server/src/actors/flow_coordinator/mod.rs
+++ b/server/crates/arbiter-server/src/actors/flow_coordinator/mod.rs
@@ -20,6 +20,8 @@ pub mod client_connect_approval;

 pub struct FlowCoordinator {
    pub clients: HashMap<ActorId, ActorRef<ClientSession>>,
+    /// Maps DB `client_id` → `ActorId` for fast connected-client lookup.
+    client_ids: HashMap<i32, ActorId>,
    operator_registry: ActorRef<OperatorRegistry>,
 }

@@ -27,6 +29,7 @@ impl FlowCoordinator {
    pub fn new(operator_registry: ActorRef<OperatorRegistry>) -> Self {
        Self {
            clients: HashMap::default(),
+            client_ids: HashMap::default(),
            operator_registry,
        }
    }
@@ -48,6 +51,7 @@ impl Actor for FlowCoordinator {
        _: ActorStopReason,
    ) -> Result<ControlFlow<ActorStopReason>, Self::Error> {
        if self.clients.remove(&id).is_some() {
+            self.client_ids.retain(|_, actor_id| *actor_id != id);
            info!(
                ?id,
                actor = "FlowCoordinator",
@@ -75,14 +79,28 @@ impl FlowCoordinator {
    #[message(ctx)]
    pub async fn register_client(
        &mut self,
+        client_id: i32,
        actor: ActorRef<ClientSession>,
        ctx: &mut Context<Self, ()>,
    ) {
-        info!(id = %actor.id(), actor = "FlowCoordinator", event = "client.connected");
+        info!(id = %actor.id(), client_id, actor = "FlowCoordinator", event = "client.connected");
        ctx.actor_ref().link(&actor).await;
+        self.client_ids.insert(client_id, actor.id());
        self.clients.insert(actor.id(), actor);
    }

+    #[message]
+    pub fn is_client_connected(&self, client_id: i32) -> bool {
+        self.client_ids.contains_key(&client_id)
+    }
+
+    /// Returns the DB `client_ids` of all currently connected SDK clients.
+    /// Used by operator sessions on startup to seed their approved-client set.
+    #[message]
+    pub fn get_connected_client_ids(&self) -> Vec<i32> {
+        self.client_ids.keys().copied().collect()
+    }
+
    #[message(ctx)]
    pub async fn request_client_approval(
        &mut self,
--- a/server/crates/arbiter-server/src/actors/vault/mod.rs
+++ b/server/crates/arbiter-server/src/actors/vault/mod.rs
@@ -22,7 +22,7 @@ use hmac::{KeyInit as _, Mac as _};
 use kameo::{Actor, Reply, actor::ActorRef, messages};
 use kameo_actors::message_bus::{MessageBus, Publish};
 use strum::{EnumDiscriminants, IntoDiscriminant};
-use tracing::{error, info};
+use tracing::{error, info, warn};

 pub mod events {

@@ -46,6 +46,8 @@ pub enum Error {
    Sealed,
    #[error("Invalid key provided")]
    InvalidKey,
+    #[error("Vault locked: too many failed unseal attempts")]
+    LockedOut,

    #[error("Requested aead entry not found")]
    NotFound,
@@ -61,6 +63,9 @@ pub enum Error {

    #[error("Broken database")]
    BrokenDatabase,
+
+    #[error("Integrity key version mismatch: envelope uses key {envelope}, current key is {current}")]
+    KeyVersionMismatch { envelope: i32, current: i32 },
 }

 struct Unsealed {
@@ -79,6 +84,8 @@ enum State {
    Unsealed(Unsealed),
 }

+const MAX_UNSEAL_ATTEMPTS: u32 = 5;
+
 /// Manages vault root key and tracks current state of the vault (bootstrapped/unbootstrapped, sealed/unsealed).
 ///
 /// Provides API for encrypting and decrypting data using the vault root key.
@@ -88,6 +95,7 @@ pub struct Vault {
    db: db::DatabasePool,
    state: State,
    events: ActorRef<MessageBus>,
+    unseal_failures: u32,
 }

 #[messages]
@@ -110,7 +118,7 @@ impl Vault {
            }
        };

-        Ok(Self { db, state, events })
+        Ok(Self { db, state, events, unseal_failures: 0 })
    }

    // Exclusive transaction to avoid race condtions if multiple vaults write
@@ -219,6 +227,10 @@ impl Vault {

    #[message]
    pub async fn try_unseal(&mut self, seal_key_raw: SafeCell<Vec<u8>>) -> Result<(), Error> {
+        if self.unseal_failures >= MAX_UNSEAL_ATTEMPTS {
+            return Err(Error::LockedOut);
+        }
+
        let State::Sealed {
            root_key_history_id,
        } = &self.state
@@ -251,13 +263,27 @@ impl Vault {
                Error::BrokenDatabase
            })?;

-        seal_key
+        if seal_key
            .decrypt_in_place(&nonce, v1::ROOT_KEY_TAG, &mut root_key)
-            .map_err(|err| {
-                error!(?err, "Failed to unseal root key: invalid seal key");
-                Error::InvalidKey
-            })?;
+            .is_err()
+        {
+            self.unseal_failures += 1;
+            if self.unseal_failures >= MAX_UNSEAL_ATTEMPTS {
+                error!(
+                    attempts = self.unseal_failures,
+                    "Vault locked: maximum failed unseal attempts reached"
+                );
+            } else {
+                warn!(
+                    attempts = self.unseal_failures,
+                    remaining = MAX_UNSEAL_ATTEMPTS - self.unseal_failures,
+                    "Failed unseal attempt"
+                );
+            }
+            return Err(Error::InvalidKey);
+        }

+        self.unseal_failures = 0;
        self.state = State::Unsealed(Unsealed {
            root_key_history_id: current_key.id,
            root_key: KeyCell::try_from(root_key).map_err(|err| {
@@ -272,8 +298,10 @@ impl Vault {
        Ok(())
    }

+    /// Decrypts an AEAD entry. The `aad` must match the value used at encryption time;
+    /// a mismatch causes authentication failure, preventing cross-wallet key swaps.
    #[message]
-    pub async fn decrypt(&mut self, aead_id: i32) -> Result<SafeCell<Vec<u8>>, Error> {
+    pub async fn decrypt(&mut self, aead_id: i32, aad: Vec<u8>) -> Result<SafeCell<Vec<u8>>, Error> {
        let Unsealed { root_key, .. } = Self::expect_unsealed(&mut self.state)?;

        let row: models::AeadEncrypted = {
@@ -295,13 +323,15 @@ impl Vault {
            Error::BrokenDatabase
        })?;
        let mut output = SafeCell::new(row.ciphertext);
-        root_key.decrypt_in_place(&nonce, v1::TAG, &mut output)?;
+        root_key.decrypt_in_place(&nonce, &aad, &mut output)?;
        Ok(output)
    }

+    /// Creates a new `aead_encrypted` entry and returns its ID.
+    /// The `aad` is bound into the ciphertext and must be reproduced exactly at decryption time.
    // Creates new `aead_encrypted` entry in the database and returns it's ID
    #[message]
-    pub async fn create_new(&mut self, mut plaintext: SafeCell<Vec<u8>>) -> Result<i32, Error> {
+    pub async fn create_new(&mut self, mut plaintext: SafeCell<Vec<u8>>, aad: Vec<u8>) -> Result<i32, Error> {
        let Unsealed {
            root_key,
            root_key_history_id,
@@ -313,7 +343,7 @@ impl Vault {

        let mut ciphertext_buffer = plaintext.write();
        let ciphertext_buffer: &mut Vec<u8> = ciphertext_buffer.as_mut();
-        root_key.encrypt_in_place(&nonce, v1::TAG, &mut *ciphertext_buffer)?;
+        root_key.encrypt_in_place(&nonce, &aad, &mut *ciphertext_buffer)?;

        let ciphertext = std::mem::take(ciphertext_buffer);

@@ -370,7 +400,10 @@ impl Vault {
        } = Self::expect_unsealed(&mut self.state)?;

        if *root_key_history_id != key_version {
-            return Ok(false);
+            return Err(Error::KeyVersionMismatch {
+                envelope: key_version,
+                current: *root_key_history_id,
+            });
        }

        let mut hmac = root_key.0.read_inline(|k| {
@@ -445,7 +478,7 @@ mod tests {
        assert_eq!(root_row.data_encryption_nonce, n2.to_vec());

        let id = actor
-            .create_new(SafeCell::new(b"post-interleave".to_vec()))
+            .create_new(SafeCell::new(b"post-interleave".to_vec()), b"test-aad".to_vec())
            .await
            .unwrap();
        let row: models::AeadEncrypted = schema::aead_encrypted::table
--- a/server/crates/arbiter-server/src/crypto/integrity/v1.rs
+++ b/server/crates/arbiter-server/src/crypto/integrity/v1.rs
@@ -192,7 +192,9 @@ pub async fn verify_entity<E: Integrable>(
        Ok(false) => Err(Error::MacMismatch {
            entity_kind: E::KIND,
        }),
-        Err(SendError::HandlerError(vault::Error::Sealed)) => Ok(AttestationStatus::Unavailable),
+        Err(SendError::HandlerError(
+            vault::Error::Sealed | vault::Error::KeyVersionMismatch { .. },
+        )) => Ok(AttestationStatus::Unavailable),
        Err(_) => Err(Error::VaultSend),
    }
 }
@@ -331,4 +333,47 @@ mod tests {
            .unwrap_err();
        assert!(matches!(err, Error::MacMismatch { .. }));
    }
+
+    #[tokio::test]
+    async fn key_version_mismatch_returns_unavailable_not_mac_mismatch() {
+        use crate::db::schema::integrity_envelope;
+        use super::AttestationStatus;
+
+        const ENTITY_ID: &[u8] = b"entity-id-rotation-test";
+
+        let db = db::create_test_pool().await;
+        let vault = bootstrapped_vault(&db).await;
+        let mut conn = db.get().await.unwrap();
+
+        let entity = DummyEntity {
+            payload_version: 1,
+            payload: b"payload-v1".to_vec(),
+        };
+
+        sign_entity(&mut conn, &vault, &entity, ENTITY_ID)
+            .await
+            .unwrap();
+
+        // Simulate key rotation: update the stored key_version to a stale value.
+        // After real rotation the vault's root_key_history_id would advance, but
+        // here we achieve the same mismatch by back-dating the envelope's key_version.
+        diesel::update(integrity_envelope::table)
+            .filter(integrity_envelope::entity_kind.eq("dummy_entity"))
+            .filter(integrity_envelope::entity_id.eq(ENTITY_ID))
+            .set(integrity_envelope::key_version.eq(0))
+            .execute(&mut conn)
+            .await
+            .unwrap();
+
+        // Must NOT error — version mismatch is Unavailable, not tampered.
+        let status = verify_entity(&mut conn, &vault, &entity, ENTITY_ID)
+            .await
+            .expect("key version mismatch must not be treated as an error");
+
+        assert_eq!(
+            status,
+            AttestationStatus::Unavailable,
+            "stale key_version must yield Unavailable, not MacMismatch"
+        );
+    }
 }
--- a/server/crates/arbiter-server/src/grpc/operator/auth.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/auth.rs
@@ -171,7 +171,7 @@ impl Receiver<auth::Inbound> for AuthTransportAdapter<'_> {

                Some(auth::Inbound::AuthChallengeRequest {
                    pubkey,
-                    bootstrap_token,
+                    bootstrap_token: bootstrap_token.map(String::into_bytes),
                })
            }
            AuthRequestPayload::ChallengeSolution(ProtoAuthChallengeSolution { signature }) => {
--- a/server/crates/arbiter-server/src/grpc/operator/evm.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/evm.rs
@@ -217,6 +217,11 @@ async fn handle_sign_transaction(
                result: Some(vet_error.convert()),
            }
        }
+        Err(kameo::error::SendError::HandlerError(
+            SessionSignTransactionError::ClientNotConnected,
+        )) => {
+            return Err(Status::permission_denied("client not connected"));
+        }
        Err(kameo::error::SendError::HandlerError(SessionSignTransactionError::Internal)) => {
            EvmSignTransactionResponse {
                result: Some(EvmSignTransactionResult::Error(
--- a/server/crates/arbiter-server/src/grpc/operator/vault_gate/outbound.rs
+++ b/server/crates/arbiter-server/src/grpc/operator/vault_gate/outbound.rs
@@ -87,6 +87,7 @@ impl TryConvert for vault_gate::Outbound {
                let proto_result = match result {
                    Ok(()) => ProtoUnsealResult::Success,
                    Err(vault_gate::Error::InvalidKey) => ProtoUnsealResult::InvalidKey,
+                    Err(vault_gate::Error::LockedOut) => ProtoUnsealResult::LockedOut,
                    Err(err) => {
                        warn!(?err, "unseal failed");
                        return Err(Status::internal("Failed to unseal vault"));
--- a/server/crates/arbiter-server/src/peers/client/auth.rs
+++ b/server/crates/arbiter-server/src/peers/client/auth.rs
@@ -8,7 +8,7 @@ use crate::{
    crypto::integrity::{self, AttestationStatus},
    db::{
        self,
-        models::{ProgramClientMetadata, SqliteTimestamp},
+        models::ProgramClientMetadata,
        schema::program_client,
    },
 };
@@ -18,14 +18,13 @@ use arbiter_proto::{
    transport::{Bi, expect_message},
 };

-use chrono::Utc;
 use diesel::{
    ExpressionMethods as _, OptionalExtension as _, QueryDsl as _, SelectableHelper as _,
-    dsl::insert_into, update,
+    dsl::insert_into,
 };
 use diesel_async::RunQueryDsl as _;
 use kameo::{actor::ActorRef, error::SendError};
-use tracing::error;
+use tracing::{error, warn};

 #[derive(thiserror::Error, Debug, Clone, PartialEq, Eq)]
 pub enum Error {
@@ -211,71 +210,47 @@ async fn insert_client(
    .await
 }

-async fn sync_client_metadata(
+/// Compares stored metadata against what a reconnecting client presents.
+/// Metadata is frozen after initial operator approval and must not be silently
+/// overwritten. Doing so would let an approved client forge its displayed
+/// identity in later approval prompts. Drift is logged and ignored.
+async fn check_metadata_drift(
    db: &db::DatabasePool,
    client_id: i32,
-    metadata: &ClientMetadata,
+    presented: &ClientMetadata,
 ) -> Result<(), Error> {
-    use crate::db::schema::{client_metadata, client_metadata_history};
-
-    let now = SqliteTimestamp(Utc::now());
+    use crate::db::schema::client_metadata;

    let mut conn = db.get().await.map_err(|e| {
        error!(error = ?e, "Database pool error");
        Error::DatabasePoolUnavailable
    })?;

-    conn.exclusive_transaction(async |conn| {
-        let (current_metadata_id, current): (i32, ProgramClientMetadata) = program_client::table
-            .find(client_id)
-            .inner_join(client_metadata::table)
-            .select((
-                program_client::metadata_id,
-                ProgramClientMetadata::as_select(),
-            ))
-            .first(&mut *conn)
-            .await?;
+    let current: ProgramClientMetadata = program_client::table
+        .find(client_id)
+        .inner_join(client_metadata::table)
+        .select(ProgramClientMetadata::as_select())
+        .first(&mut conn)
+        .await
+        .map_err(|e| {
+            error!(error = ?e, "Database error");
+            Error::DatabaseOperationFailed
+        })?;

-        let unchanged = current.name == metadata.name
-            && current.description == metadata.description
-            && current.version == metadata.version;
-        if unchanged {
-            return Ok(());
-        }
+    let changed = current.name != presented.name
+        || current.description != presented.description
+        || current.version != presented.version;

-        insert_into(client_metadata_history::table)
-            .values((
-                client_metadata_history::metadata_id.eq(current_metadata_id),
-                client_metadata_history::client_id.eq(client_id),
-            ))
-            .execute(&mut *conn)
-            .await?;
+    if changed {
+        warn!(
+            client_id,
+            stored_name = %current.name,
+            presented_name = %presented.name,
+            "reconnecting client presented different metadata; ignoring - metadata is frozen after operator approval"
+        );
+    }

-        let metadata_id = insert_into(client_metadata::table)
-            .values((
-                client_metadata::name.eq(&metadata.name),
-                client_metadata::description.eq(&metadata.description),
-                client_metadata::version.eq(&metadata.version),
-            ))
-            .returning(client_metadata::id)
-            .get_result::<i32>(&mut *conn)
-            .await?;
-
-        update(program_client::table.find(client_id))
-            .set((
-                program_client::metadata_id.eq(metadata_id),
-                program_client::updated_at.eq(now),
-            ))
-            .execute(&mut *conn)
-            .await?;
-
-        Ok::<(), diesel::result::Error>(())
-    })
-    .await
-    .map_err(|e| {
-        error!(error = ?e, "Database error");
-        Error::DatabaseOperationFailed
-    })
+    Ok(())
 }

 async fn challenge_client<T>(
@@ -324,6 +299,7 @@ where

    let client_id = if let Some(id) = get_client_id(&props.db, &pubkey).await? {
        verify_integrity(&props.db, &props.actors.vault, &pubkey).await?;
+        check_metadata_drift(&props.db, id, &metadata).await?;
        id
    } else {
        approve_new_client(
@@ -337,8 +313,6 @@ where
        insert_client(&props.db, &props.actors.vault, &pubkey, &metadata).await?
    };

-    sync_client_metadata(&props.db, client_id, &metadata).await?;
-
    let challenge = AuthChallenge::generate(&mut rand::rng());
    challenge_client(transport, pubkey, challenge).await?;

--- a/server/crates/arbiter-server/src/peers/client/session.rs
+++ b/server/crates/arbiter-server/src/peers/client/session.rs
@@ -83,7 +83,7 @@ impl Actor for ClientSession {
        args.props
            .actors
            .flow_coordinator
-            .ask(RegisterClient { actor: this })
+            .ask(RegisterClient { client_id: args.client_id, actor: this })
            .await
            .map_err(|_| Error::ConnectionRegistrationFailed)?;
        Ok(args)
--- a/server/crates/arbiter-server/src/peers/operator/auth/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/auth/mod.rs
@@ -14,7 +14,7 @@ mod state;
 pub enum Inbound {
    AuthChallengeRequest {
        pubkey: authn::PublicKey,
-        bootstrap_token: Option<String>,
+        bootstrap_token: Option<Vec<u8>>,
    },
    AuthChallengeSolution {
        signature: Vec<u8>,
--- a/server/crates/arbiter-server/src/peers/operator/auth/state.rs
+++ b/server/crates/arbiter-server/src/peers/operator/auth/state.rs
@@ -16,13 +16,12 @@ use tracing::error;

 pub(super) struct ChallengeRequest {
    pub(super) pubkey: authn::PublicKey,
-    pub(super) bootstrap_token: Option<String>,
+    pub(super) bootstrap_token: Option<Vec<u8>>,
 }

 pub struct ChallengeContext {
    pub(super) challenge: AuthChallenge,
    pub(super) pubkey: authn::PublicKey,
-    pub(super) bootstrap_token: Option<String>,
 }

 pub(super) struct ChallengeSolution {
@@ -79,11 +78,16 @@ async fn register_key(db: &DatabasePool, pubkey: &authn::PublicKey) -> Result<i3
 pub(super) struct AuthContext<'a, T: ?Sized> {
    pub(super) conn: &'a mut OperatorConnection,
    pub(super) transport: &'a mut T,
+    bootstrap_token: Option<Vec<u8>>,
 }

 impl<'a, T: ?Sized> AuthContext<'a, T> {
    pub(super) const fn new(conn: &'a mut OperatorConnection, transport: &'a mut T) -> Self {
-        Self { conn, transport }
+        Self {
+            conn,
+            transport,
+            bootstrap_token: None,
+        }
    }
 }

@@ -108,6 +112,8 @@ where
            }
        }

+        self.bootstrap_token = bootstrap_token;
+
        let challenge = AuthChallenge::generate(&mut rand::rng());

        self.transport
@@ -120,20 +126,12 @@ where
                Error::Transport
            })?;

-        Ok(ChallengeContext {
-            challenge,
-            pubkey,
-            bootstrap_token,
-        })
+        Ok(ChallengeContext { challenge, pubkey })
    }

    async fn verify_solution(
        &mut self,
-        ChallengeContext {
-            challenge,
-            pubkey,
-            bootstrap_token,
-        }: &ChallengeContext,
+        ChallengeContext { challenge, pubkey }: &ChallengeContext,
        ChallengeSolution { solution }: ChallengeSolution,
    ) -> Result<Credentials, Self::Error> {
        let signature = authn::Signature::try_from(solution.as_slice()).map_err(|()| {
@@ -152,15 +150,13 @@ where
        }

        // Resolve client id: bootstrap (consume token + register) or lookup
-        let id = match bootstrap_token {
+        let id = match self.bootstrap_token.take() {
            Some(token) => {
                let token_ok: bool = self
                    .conn
                    .actors
                    .bootstrapper
-                    .ask(ConsumeToken {
-                        token: token.clone(),
-                    })
+                    .ask(ConsumeToken { token })
                    .await
                    .map_err(|e| {
                        error!(?e, "Failed to consume bootstrap token");
--- a/server/crates/arbiter-server/src/peers/operator/session/handlers.rs
+++ b/server/crates/arbiter-server/src/peers/operator/session/handlers.rs
@@ -4,9 +4,12 @@ use crate::{
        ClientSignTransaction, Generate, ListWallets, OperatorCreateGrant, OperatorListGrants,
        SignTransactionError as EvmSignError,
    },
-    actors::flow_coordinator::client_connect_approval::ClientApprovalAnswer,
+    actors::flow_coordinator::{IsClientConnected, client_connect_approval::ClientApprovalAnswer},
    actors::vault::VaultState,
-    db::models::{EvmWalletAccess, NewEvmWalletAccess, ProgramClient, ProgramClientMetadata},
+    db::{
+        models::{EvmWalletAccess, NewEvmWalletAccess, ProgramClient, ProgramClientMetadata},
+        schema::program_client,
+    },
    evm::policies::{Grant, SpecificGrant},
 };
 use arbiter_crypto::authn;
@@ -15,13 +18,16 @@ use alloy::{consensus::TxEip1559, primitives::Address, signers::Signature};
 use diesel::{ExpressionMethods as _, QueryDsl as _, SelectableHelper};
 use diesel_async::{AsyncConnection, RunQueryDsl};
 use kameo::{error::SendError, messages, prelude::Context};
-use tracing::error;
+use tracing::{error, info, warn};

 #[derive(Debug, Error)]
 pub enum SignTransactionError {
    #[error("Policy evaluation failed")]
    Vet(#[from] crate::evm::VetError),

+    #[error("Client not connected")]
+    ClientNotConnected,
+
    #[error("Internal signing error")]
    Internal,
 }
@@ -141,6 +147,30 @@ impl OperatorSession {
        wallet_address: Address,
        transaction: TxEip1559,
    ) -> Result<Signature, SignTransactionError> {
+        if !self.approved_client_ids.contains(&client_id) {
+            warn!(
+                client_id,
+                "operator attempted to sign for client not in its approved set"
+            );
+            return Err(SignTransactionError::ClientNotConnected);
+        }
+
+        let connected = self
+            .props
+            .actors
+            .flow_coordinator
+            .ask(IsClientConnected { client_id })
+            .await
+            .unwrap_or(false);
+
+        if !connected {
+            self.approved_client_ids.remove(&client_id);
+            warn!(client_id, "operator attempted to sign for disconnected client");
+            return Err(SignTransactionError::ClientNotConnected);
+        }
+
+        info!(client_id, event = "sign_transaction", "operator.sign_transaction");
+
        match self
            .props
            .actors
@@ -196,7 +226,7 @@ impl OperatorSession {
            use crate::db::schema::evm_wallet_access;
            for entry in entries {
                diesel::delete(evm_wallet_access::table)
-                    .filter(evm_wallet_access::wallet_id.eq(entry))
+                    .filter(evm_wallet_access::id.eq(entry))
                    .execute(&mut *conn)
                    .await?;
            }
@@ -249,6 +279,30 @@ impl OperatorSession {

        ctx.actor_ref().unlink(&pending_approval.controller).await;

+        if approved {
+            let pubkey_bytes = pending_approval.pubkey.to_bytes();
+            match self.props.db.get().await {
+                Ok(mut conn) => {
+                    match program_client::table
+                        .filter(program_client::public_key.eq(pubkey_bytes.as_slice()))
+                        .select(program_client::id)
+                        .first::<i32>(&mut conn)
+                        .await
+                    {
+                        Ok(client_id) => {
+                            self.approved_client_ids.insert(client_id);
+                        }
+                        Err(err) => {
+                            error!(?err, "Failed to look up client_id for approved pubkey");
+                        }
+                    }
+                }
+                Err(err) => {
+                    error!(?err, "DB pool error after client approval");
+                }
+            }
+        }
+
        Ok(())
    }

@@ -271,3 +325,142 @@ impl OperatorSession {
        Ok(clients)
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use crate::db::{self, models::NewEvmWalletAccess, schema::evm_wallet_access};
+    use diesel::{ExpressionMethods as _, QueryDsl as _, SelectableHelper};
+    use diesel_async::{AsyncConnection, RunQueryDsl};
+
+    /// Regression test: revocation must delete by access-entry `id`, not by `wallet_id`.
+    ///
+    /// Before the fix, revoking `entry_id=1` would delete all rows where `wallet_id=1`,
+    /// wiping out every client's access to wallet #1.
+    #[tokio::test]
+    async fn revoke_deletes_by_entry_id_not_wallet_id() {
+        use crate::db::models::EvmWalletAccess;
+
+        let pool = db::create_test_pool().await;
+        let mut conn = pool.get().await.expect("pool connection");
+
+        // Insert two access entries for the same wallet but different clients.
+        // entry A: id will be 1, wallet_id=1, client_id=10
+        // entry B: id will be 2, wallet_id=1, client_id=20
+        let entry_a = diesel::insert_into(evm_wallet_access::table)
+            .values(NewEvmWalletAccess {
+                wallet_id: 1,
+                client_id: 10,
+            })
+            .returning(EvmWalletAccess::as_select())
+            .get_result(&mut *conn)
+            .await
+            .expect("insert entry A");
+
+        let entry_b = diesel::insert_into(evm_wallet_access::table)
+            .values(NewEvmWalletAccess {
+                wallet_id: 1,
+                client_id: 20,
+            })
+            .returning(EvmWalletAccess::as_select())
+            .get_result(&mut *conn)
+            .await
+            .expect("insert entry B");
+
+        // Revoke only entry A by its primary key id.
+        conn.transaction(async |conn| {
+            diesel::delete(evm_wallet_access::table)
+                .filter(evm_wallet_access::id.eq(entry_a.id))
+                .execute(&mut *conn)
+                .await
+        })
+        .await
+        .expect("revoke entry A");
+
+        // Entry A must be gone.
+        let gone = evm_wallet_access::table
+            .filter(evm_wallet_access::id.eq(entry_a.id))
+            .count()
+            .get_result::<i64>(&mut *conn)
+            .await
+            .expect("count entry A");
+        assert_eq!(gone, 0, "revoked entry must be deleted");
+
+        // Entry B (same wallet, different client) must still exist.
+        let still_there = evm_wallet_access::table
+            .filter(evm_wallet_access::id.eq(entry_b.id))
+            .count()
+            .get_result::<i64>(&mut *conn)
+            .await
+            .expect("count entry B");
+        assert_eq!(still_there, 1, "unrelated entry must not be deleted");
+    }
+
+    /// Regression test: when `entry_id` and `wallet_id` differ, only the correct row is removed.
+    ///
+    /// This specifically catches the case where `entry.id=5` and `wallet_id=1` are different values;
+    /// the old bug would delete by `wallet_id`, potentially matching a completely different entry.
+    #[tokio::test]
+    async fn revoke_with_mismatched_wallet_and_entry_ids() {
+        use crate::db::models::EvmWalletAccess;
+
+        let pool = db::create_test_pool().await;
+        let mut conn = pool.get().await.expect("pool connection");
+
+        // Insert entries to force auto-increment IDs to diverge from wallet_ids.
+        // We'll insert 5 placeholder entries first so that the real entry gets id=6.
+        for i in 1_i32..=5 {
+            diesel::insert_into(evm_wallet_access::table)
+                .values(NewEvmWalletAccess {
+                    wallet_id: 99,
+                    client_id: i,
+                })
+                .execute(&mut *conn)
+                .await
+                .expect("insert placeholder");
+        }
+
+        // Real target: wallet_id=1, will get id=6.
+        let target = diesel::insert_into(evm_wallet_access::table)
+            .values(NewEvmWalletAccess {
+                wallet_id: 1,
+                client_id: 1,
+            })
+            .returning(EvmWalletAccess::as_select())
+            .get_result(&mut *conn)
+            .await
+            .expect("insert target");
+
+        // Sanity: target.id != target.wallet_id
+        assert_ne!(
+            target.id, target.wallet_id,
+            "test prerequisite: id and wallet_id must differ"
+        );
+
+        // Revoke by entry id.
+        conn.transaction(async |conn| {
+            diesel::delete(evm_wallet_access::table)
+                .filter(evm_wallet_access::id.eq(target.id))
+                .execute(&mut *conn)
+                .await
+        })
+        .await
+        .expect("revoke target");
+
+        let remaining = evm_wallet_access::table
+            .filter(evm_wallet_access::id.eq(target.id))
+            .count()
+            .get_result::<i64>(&mut *conn)
+            .await
+            .expect("count target");
+        assert_eq!(remaining, 0, "target must be deleted by its entry id");
+
+        // Placeholders for wallet_id=99 must be untouched.
+        let placeholders = evm_wallet_access::table
+            .filter(evm_wallet_access::wallet_id.eq(99))
+            .count()
+            .get_result::<i64>(&mut *conn)
+            .await
+            .expect("count placeholders");
+        assert_eq!(placeholders, 5, "unrelated entries must survive");
+    }
+}
--- a/server/crates/arbiter-server/src/peers/operator/session/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/session/mod.rs
@@ -1,16 +1,14 @@
 use super::{OutOfBand, OperatorConnection};
 use crate::{
    actors::{
-        flow_coordinator::client_connect_approval::{ClientApprovalAnswer, ClientApprovalController},
-        operator_registry::ConnectOperator,
-    },
-    peers::client::ClientProfile,
+        flow_coordinator::{GetConnectedClientIds, client_connect_approval::{ClientApprovalAnswer, ClientApprovalController}}, operator_registry::ConnectOperator,
+    }, peers::client::ClientProfile,
 };
 use arbiter_crypto::authn;
 use arbiter_proto::transport::Sender;

 use kameo::{Actor, actor::ActorRef, messages};
-use std::{borrow::Cow, collections::HashMap};
+use std::{borrow::Cow, collections::{HashMap, HashSet}};
 use thiserror::Error;
 use tracing::error;

@@ -54,6 +52,10 @@ pub struct OperatorSession {
    sender: Box<dyn Sender<OutOfBand>>,

    pending_client_approvals: HashMap<Vec<u8>, PendingClientApproval>,
+    /// DB `client_ids` this operator session is allowed to sign for.
+    /// Seeded from currently-connected clients on start, then updated as
+    /// approvals are granted or denied during the session lifetime.
+    approved_client_ids: HashSet<i32>,
 }

 pub mod handlers;
@@ -64,6 +66,7 @@ impl OperatorSession {
            props,
            sender,
            pending_client_approvals: HashMap::default(),
+            approved_client_ids: HashSet::default(),
        }
    }
 }
@@ -107,7 +110,7 @@ impl Actor for OperatorSession {

    type Error = Error;

-    async fn on_start(args: Self::Args, this: ActorRef<Self>) -> Result<Self, Self::Error> {
+    async fn on_start(mut args: Self::Args, this: ActorRef<Self>) -> Result<Self, Self::Error> {
        args.props
            .actors
            .operator_registry
@@ -122,6 +125,16 @@ impl Actor for OperatorSession {
                );
                Error::internal("Failed to register operator connection with operator registry")
            })?;
+
+        // Seed approved set with clients already connected when this session starts.
+        // New clients will be added via handle_new_client_approve as they are approved.
+        match args.props.actors.flow_coordinator.ask(GetConnectedClientIds {}).await {
+            Ok(ids) => args.approved_client_ids.extend(ids),
+            Err(err) => {
+                error!(?err, "Failed to fetch connected client IDs on operator session start");
+            }
+        }
+
        Ok(args)
    }

--- a/server/crates/arbiter-server/src/peers/operator/vault_gate/mod.rs
+++ b/server/crates/arbiter-server/src/peers/operator/vault_gate/mod.rs
@@ -11,7 +11,7 @@ use arbiter_crypto::safecell::{SafeCell, SafeCellHandle as _};
 use state::State;

 use chacha20poly1305::{AeadInPlace, KeyInit as _, XChaCha20Poly1305, XNonce};
-use kameo::{Actor, error::SendError, messages, prelude::Message};
+use kameo::{Actor, error::SendError, messages, prelude::{Context, Message}};
 use kameo_actors::message_bus::Register;
 use tokio::sync::oneshot;
 use tracing::{error, info};
@@ -25,6 +25,8 @@ pub enum Error {
    AlreadyBootstrapped,
    #[error("Invalid key provided")]
    InvalidKey,
+    #[error("Vault locked: too many failed unseal attempts")]
+    LockedOut,

    #[error("State transition failed")]
    State,
@@ -141,12 +143,13 @@ impl VaultGate {
        })
    }

-    #[message]
+    #[message(ctx)]
    pub async fn handle_unseal_encrypted_key(
        &mut self,
        nonce: Vec<u8>,
        ciphertext: Vec<u8>,
        associated_data: Vec<u8>,
+        ctx: &mut Context<Self, Result<(), Error>>,
    ) -> Result<(), Error> {
        let State::ReadyForExchange { secret, .. } = &self.state else {
            return Err(Error::State);
@@ -170,6 +173,12 @@ impl VaultGate {
                Ok(())
            }
            Err(SendError::HandlerError(vault::Error::InvalidKey)) => Err(Error::InvalidKey),
+            Err(SendError::HandlerError(vault::Error::LockedOut)) => {
+                // Vault is permanently locked — terminate this gate so the
+                // run_vault_gate loop breaks and the connection is closed.
+                ctx.stop();
+                Err(Error::LockedOut)
+            }
            Err(SendError::HandlerError(err)) => {
                error!(?err, "Vault failed to unseal key");
                Err(Error::InvalidKey)
@@ -242,7 +251,7 @@ impl Message<events::Bootstrapped> for VaultGate {
    async fn handle(
        &mut self,
        _: events::Bootstrapped,
-        ctx: &mut kameo::prelude::Context<Self, Self::Reply>,
+        ctx: &mut Context<Self, Self::Reply>,
    ) -> Self::Reply {
        let result = async {
            let mut conn = self
@@ -278,7 +287,7 @@ impl Message<events::Unsealed> for VaultGate {
    async fn handle(
        &mut self,
        _: events::Unsealed,
-        ctx: &mut kameo::prelude::Context<Self, Self::Reply>,
+        ctx: &mut Context<Self, Self::Reply>,
    ) -> Self::Reply {
        if let Some(tx) = self.promotion_tx.take() {
            let _ = tx.send(Ok(()));
--- a/server/crates/arbiter-server/tests/client/auth.rs
+++ b/server/crates/arbiter-server/tests/client/auth.rs
@@ -16,7 +16,7 @@ use arbiter_server::{

 use diesel::{ExpressionMethods as _, NullableExpressionMethods as _, QueryDsl as _, insert_into};
 use diesel_async::RunQueryDsl;
-use ml_dsa::{Generate as _, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
+use ml_dsa::{KeyGen, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};

 fn metadata(name: &str, description: Option<&str>, version: Option<&str>) -> ClientMetadata {
    ClientMetadata {
@@ -73,7 +73,7 @@ async fn insert_registered_client(

 fn sign_client_challenge(key: &SigningKey<MlDsa87>, challenge: &AuthChallenge) -> authn::Signature {
    let challenge = challenge.format();
-    key.expanded_key()
+    key.signing_key()
        .sign_deterministic(&challenge, CLIENT_CONTEXT)
        .unwrap()
        .into()
@@ -81,7 +81,7 @@ fn sign_client_challenge(key: &SigningKey<MlDsa87>, challenge: &AuthChallenge) -

 async fn insert_bootstrap_sentinel_operator(db: &db::DatabasePool) {
    let mut conn = db.get().await.unwrap();
-    let sentinel_key = verifying_key(&SigningKey::<MlDsa87>::generate())
+    let sentinel_key = verifying_key(&MlDsa87::key_gen(&mut rand::rng()))
        .encode()
        .0
        .to_vec();
@@ -120,7 +120,7 @@ pub async fn unregistered_pubkey_rejected() {
        connect_client(props, &mut server_transport).await;
    });

-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());

    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
@@ -140,7 +140,7 @@ pub async fn challenge_auth() {
    let db = db::create_test_pool().await;
    let actors = spawn_test_actors(&db).await;

-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());

    Box::pin(insert_registered_client(
        &db,
@@ -206,7 +206,7 @@ pub async fn challenge_auth() {
 pub async fn metadata_unchanged_does_not_append_history() {
    let db = db::create_test_pool().await;
    let actors = spawn_test_actors(&db).await;
-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
    let requested = metadata("client", Some("desc"), Some("1.0.0"));

    Box::pin(insert_registered_client(
@@ -266,10 +266,10 @@ pub async fn metadata_unchanged_does_not_append_history() {

 #[tokio::test]
 #[test_log::test]
-pub async fn metadata_change_appends_history_and_repoints_binding() {
+pub async fn metadata_frozen_after_approval_ignores_reconnect_changes() {
    let db = db::create_test_pool().await;
    let actors = spawn_test_actors(&db).await;
-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());

    Box::pin(insert_registered_client(
        &db,
@@ -287,6 +287,7 @@ pub async fn metadata_change_appends_history_and_repoints_binding() {
        connect_client(props, &mut server_transport).await;
    });

+    // Reconnect presenting different metadata — must be silently ignored.
    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
            pubkey: verifying_key(&new_key).into(),
@@ -313,6 +314,7 @@ pub async fn metadata_change_appends_history_and_repoints_binding() {
            client_metadata, client_metadata_history, program_client,
        };
        let mut conn = db.get().await.unwrap();
+        // Metadata is frozen: no new row, no history entry.
        let metadata_count: i64 = client_metadata::table
            .count()
            .get_result(&mut conn)
@@ -338,15 +340,16 @@ pub async fn metadata_change_appends_history_and_repoints_binding() {
            .first::<(String, Option<String>, Option<String>)>(&mut conn)
            .await
            .unwrap();
-        assert_eq!(metadata_count, 2);
-        assert_eq!(history_count, 1);
+        assert_eq!(metadata_count, 1, "frozen: no new metadata row on reconnect");
+        assert_eq!(history_count, 0, "frozen: no history entry on reconnect");
        assert_eq!(
            current,
            (
                "client".to_owned(),
-                Some("new".to_owned()),
-                Some("2.0.0".to_owned())
-            )
+                Some("old".to_owned()),
+                Some("1.0.0".to_owned())
+            ),
+            "frozen: original metadata must be preserved"
        );
    }
 }
@@ -357,7 +360,7 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch() {
    let db = db::create_test_pool().await;
    let actors = spawn_test_actors(&db).await;

-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
    let requested = metadata("client", Some("desc"), Some("1.0.0"));

    {
--- a/server/crates/arbiter-server/tests/operator/auth.rs
+++ b/server/crates/arbiter-server/tests/operator/auth.rs
@@ -14,7 +14,7 @@ use arbiter_server::{
 use async_trait::async_trait;
 use diesel::{ExpressionMethods as _, QueryDsl, insert_into};
 use diesel_async::RunQueryDsl;
-use ml_dsa::{Generate as _, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
+use ml_dsa::{KeyGen, MlDsa87, SigningKey, VerifyingKey, signature::Keypair};
 use tokio::sync::mpsc;

 fn verifying_key(key: &SigningKey<MlDsa87>) -> VerifyingKey<MlDsa87> {
@@ -26,7 +26,7 @@ fn sign_operator_challenge(
    challenge: &AuthChallenge,
 ) -> authn::Signature {
    let challenge = challenge.format();
-    key.expanded_key()
+    key.signing_key()
        .sign_deterministic(&challenge, OPERATOR_CONTEXT)
        .unwrap()
        .into()
@@ -170,11 +170,11 @@ pub async fn bootstrap_token_auth() {
        auth::authenticate(&mut props, &mut server_transport).await
    });

-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
            pubkey: verifying_key(&new_key).into(),
-            bootstrap_token: Some(token),
+            bootstrap_token: Some(token.into_bytes()),
        })
        .await
        .unwrap();
@@ -227,11 +227,11 @@ pub async fn bootstrap_invalid_token_auth() {
        auth::authenticate(&mut props, &mut server_transport).await
    });

-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
    test_transport
        .send(auth::Inbound::AuthChallengeRequest {
            pubkey: verifying_key(&new_key).into(),
-            bootstrap_token: Some("invalid_token".to_owned()),
+            bootstrap_token: Some(b"invalid_token".to_vec()),
        })
        .await
        .unwrap();
@@ -280,7 +280,7 @@ pub async fn challenge_auth() {
        .await
        .unwrap();

-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
    let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();

    {
@@ -366,7 +366,7 @@ pub async fn challenge_auth_rejects_integrity_tag_mismatch_when_unsealed() {
        .await
        .unwrap();

-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
    let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();

    {
@@ -439,7 +439,7 @@ pub async fn challenge_auth_rejects_invalid_signature() {
        .await
        .unwrap();

-    let new_key = SigningKey::<MlDsa87>::generate();
+    let new_key = MlDsa87::key_gen(&mut rand::rng());
    let pubkey_bytes = authn::PublicKey::from(verifying_key(&new_key)).to_bytes();

    {
--- a/server/crates/arbiter-server/tests/operator/unseal.rs
+++ b/server/crates/arbiter-server/tests/operator/unseal.rs
@@ -140,6 +140,47 @@ pub async fn unseal_corrupted_ciphertext() {
    ));
 }

+/// After MAX_UNSEAL_ATTEMPTS wrong keys, the vault locks and the VaultGate
+/// must stop itself so the connection is dropped.
+#[tokio::test]
+#[test_log::test]
+pub async fn lockout_stops_vault_gate() {
+    use kameo::error::SendError;
+
+    let seal_key = b"real-seal-key";
+    let (_db, gate, _promotion_rx) = setup_sealed_gate(seal_key).await;
+
+    // Exhaust all MAX_UNSEAL_ATTEMPTS (5) with wrong keys; each returns InvalidKey.
+    for _ in 0..5 {
+        let encrypted_key = client_dh_encrypt(&gate, b"wrong-key").await;
+        assert!(matches!(
+            gate.ask(encrypted_key).await,
+            Err(SendError::HandlerError(VaultGateError::InvalidKey))
+        ));
+    }
+
+    // Sixth attempt: vault is now locked, returns LockedOut, and the gate stops itself.
+    let encrypted_key = client_dh_encrypt(&gate, b"wrong-key").await;
+    assert!(matches!(
+        gate.ask(encrypted_key).await,
+        Err(SendError::HandlerError(VaultGateError::LockedOut))
+    ));
+
+    // Give the actor scheduler time to process the stop signal.
+    tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+
+    // Any subsequent message must be rejected because the gate is stopped.
+    let client_secret = EphemeralSecret::random();
+    let client_public = PublicKey::from(&client_secret);
+    assert!(
+        matches!(
+            gate.ask(HandleHandshake { client_pubkey: client_public }).await,
+            Err(SendError::ActorNotRunning(_))
+        ),
+        "VaultGate must be stopped after LockedOut"
+    );
+}
+
 #[tokio::test]
 #[test_log::test]
 pub async fn unseal_retry_after_invalid_key() {
--- a/server/crates/arbiter-server/tests/vault/concurrency.rs
+++ b/server/crates/arbiter-server/tests/vault/concurrency.rs
@@ -14,6 +14,8 @@ use kameo::actor::{ActorRef, Spawn as _};
 use std::collections::{HashMap, HashSet};
 use tokio::task::JoinSet;

+const TEST_AAD: &[u8] = b"test-aad";
+
 async fn write_concurrently(
    actor: ActorRef<Vault>,
    prefix: &'static str,
@@ -27,6 +29,7 @@ async fn write_concurrently(
            let id = actor
                .ask(CreateNew {
                    plaintext: SafeCell::new(plaintext.clone()),
+                    aad: TEST_AAD.to_vec(),
                })
                .await
                .unwrap();
@@ -120,7 +123,7 @@ async fn insert_failure_does_not_create_partial_row() {
    drop(conn);

    let err = actor
-        .create_new(SafeCell::new(b"should fail".to_vec()))
+        .create_new(SafeCell::new(b"should fail".to_vec()), TEST_AAD.to_vec())
        .await
        .unwrap_err();
    assert!(matches!(err, Error::DatabaseTransaction(_)));
@@ -171,7 +174,7 @@ async fn decrypt_roundtrip_after_high_concurrency() {
        .unwrap();

    for (id, plaintext) in expected {
-        let mut decrypted = decryptor.decrypt(id).await.unwrap();
+        let mut decrypted = decryptor.decrypt(id, TEST_AAD.to_vec()).await.unwrap();
        assert_eq!(*decrypted.read(), plaintext);
    }
 }
--- a/server/crates/arbiter-server/tests/vault/lifecycle.rs
+++ b/server/crates/arbiter-server/tests/vault/lifecycle.rs
@@ -12,6 +12,8 @@ use arbiter_server::{
 use diesel::{QueryDsl, SelectableHelper};
 use diesel_async::RunQueryDsl;

+const TEST_AAD: &[u8] = b"test-aad";
+
 #[tokio::test]
 #[test_log::test]
 async fn bootstrap() {
@@ -57,7 +59,7 @@ async fn create_new_before_bootstrap_fails() {
        .unwrap();

    let err = actor
-        .create_new(SafeCell::new(b"data".to_vec()))
+        .create_new(SafeCell::new(b"data".to_vec()), TEST_AAD.to_vec())
        .await
        .unwrap_err();
    assert!(matches!(err, Error::NotBootstrapped));
@@ -71,7 +73,7 @@ async fn decrypt_before_bootstrap_fails() {
        .await
        .unwrap();

-    let err = actor.decrypt(1).await.unwrap_err();
+    let err = actor.decrypt(1, TEST_AAD.to_vec()).await.unwrap_err();
    assert!(matches!(err, Error::NotBootstrapped));
 }

@@ -85,7 +87,7 @@ async fn new_restores_sealed_state() {
    let mut actor2 = Vault::new(db, GlobalActors::spawn_message_bus())
        .await
        .unwrap();
-    let err = actor2.decrypt(1).await.unwrap_err();
+    let err = actor2.decrypt(1, TEST_AAD.to_vec()).await.unwrap_err();
    assert!(matches!(err, Error::Sealed));
 }

@@ -97,7 +99,7 @@ async fn unseal_correct_password() {

    let plaintext = b"survive a restart";
    let aead_id = actor
-        .create_new(SafeCell::new(plaintext.to_vec()))
+        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
        .await
        .unwrap();
    drop(actor);
@@ -108,7 +110,7 @@ async fn unseal_correct_password() {
    let seal_key = SafeCell::new(b"test-seal-key".to_vec());
    actor.try_unseal(seal_key).await.unwrap();

-    let mut decrypted = actor.decrypt(aead_id).await.unwrap();
+    let mut decrypted = actor.decrypt(aead_id, TEST_AAD.to_vec()).await.unwrap();
    assert_eq!(*decrypted.read(), plaintext);
 }

@@ -120,7 +122,7 @@ async fn unseal_wrong_then_correct_password() {

    let plaintext = b"important data";
    let aead_id = actor
-        .create_new(SafeCell::new(plaintext.to_vec()))
+        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
        .await
        .unwrap();
    drop(actor);
@@ -136,6 +138,6 @@ async fn unseal_wrong_then_correct_password() {
    let good_key = SafeCell::new(b"test-seal-key".to_vec());
    actor.try_unseal(good_key).await.unwrap();

-    let mut decrypted = actor.decrypt(aead_id).await.unwrap();
+    let mut decrypted = actor.decrypt(aead_id, TEST_AAD.to_vec()).await.unwrap();
    assert_eq!(*decrypted.read(), plaintext);
 }
--- a/server/crates/arbiter-server/tests/vault/storage.rs
+++ b/server/crates/arbiter-server/tests/vault/storage.rs
@@ -10,6 +10,8 @@ use diesel::{ExpressionMethods as _, QueryDsl, SelectableHelper, dsl::update};
 use diesel_async::RunQueryDsl;
 use std::collections::HashSet;

+const TEST_AAD: &[u8] = b"test-aad";
+
 #[tokio::test]
 #[test_log::test]
 async fn create_decrypt_roundtrip() {
@@ -18,11 +20,11 @@ async fn create_decrypt_roundtrip() {

    let plaintext = b"hello arbiter";
    let aead_id = actor
-        .create_new(SafeCell::new(plaintext.to_vec()))
+        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
        .await
        .unwrap();

-    let mut decrypted = actor.decrypt(aead_id).await.unwrap();
+    let mut decrypted = actor.decrypt(aead_id, TEST_AAD.to_vec()).await.unwrap();
    assert_eq!(*decrypted.read(), plaintext);
 }

@@ -32,7 +34,7 @@ async fn decrypt_nonexistent_returns_not_found() {
    let db = db::create_test_pool().await;
    let mut actor = common::bootstrapped_vault(&db).await;

-    let err = actor.decrypt(9999).await.unwrap_err();
+    let err = actor.decrypt(9999, TEST_AAD.to_vec()).await.unwrap_err();
    assert!(matches!(err, Error::NotFound));
 }

@@ -44,11 +46,11 @@ async fn ciphertext_differs_across_entries() {

    let plaintext = b"same content";
    let id1 = actor
-        .create_new(SafeCell::new(plaintext.to_vec()))
+        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
        .await
        .unwrap();
    let id2 = actor
-        .create_new(SafeCell::new(plaintext.to_vec()))
+        .create_new(SafeCell::new(plaintext.to_vec()), TEST_AAD.to_vec())
        .await
        .unwrap();

@@ -68,8 +70,8 @@ async fn ciphertext_differs_across_entries() {

    assert_ne!(row1.ciphertext, row2.ciphertext);

-    let mut d1 = actor.decrypt(id1).await.unwrap();
-    let mut d2 = actor.decrypt(id2).await.unwrap();
+    let mut d1 = actor.decrypt(id1, TEST_AAD.to_vec()).await.unwrap();
+    let mut d2 = actor.decrypt(id2, TEST_AAD.to_vec()).await.unwrap();
    assert_eq!(*d1.read(), plaintext);
    assert_eq!(*d2.read(), plaintext);
 }
@@ -83,7 +85,7 @@ async fn nonce_never_reused() {
    let n = 5;
    for i in 0..n {
        actor
-            .create_new(SafeCell::new(format!("secret {i}").into_bytes()))
+            .create_new(SafeCell::new(format!("secret {i}").into_bytes()), TEST_AAD.to_vec())
            .await
            .unwrap();
    }
@@ -137,7 +139,7 @@ async fn broken_db_nonce_format_fails_closed() {
    drop(conn);

    let err = actor
-        .create_new(SafeCell::new(b"must fail".to_vec()))
+        .create_new(SafeCell::new(b"must fail".to_vec()), TEST_AAD.to_vec())
        .await
        .unwrap_err();
    assert!(matches!(err, Error::BrokenDatabase));
@@ -145,7 +147,7 @@ async fn broken_db_nonce_format_fails_closed() {
    let db = db::create_test_pool().await;
    let mut actor = common::bootstrapped_vault(&db).await;
    let id = actor
-        .create_new(SafeCell::new(b"decrypt target".to_vec()))
+        .create_new(SafeCell::new(b"decrypt target".to_vec()), TEST_AAD.to_vec())
        .await
        .unwrap();
    let mut conn = db.get().await.unwrap();
@@ -156,6 +158,6 @@ async fn broken_db_nonce_format_fails_closed() {
        .unwrap();
    drop(conn);

-    let err = actor.decrypt(id).await.unwrap_err();
+    let err = actor.decrypt(id, TEST_AAD.to_vec()).await.unwrap_err();
    assert!(matches!(err, Error::BrokenDatabase));
 }
Author	SHA1	Message	Date
CleverWild	a30bef11da	fix: terminate VaultGate connection after vault lockout Some checks failed ci/woodpecker/pr/server-audit Pipeline failed Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline was successful Details ci/woodpecker/pr/server-test Pipeline was successful Details	2026-06-30 20:07:01 +02:00
Stas	357726bc5d	Merge pull request 'security: batch of fixes' (#95 ) from zeroized-bootstrap-token into main Some checks failed ci/woodpecker/push/server-audit Pipeline failed Details ci/woodpecker/push/server-vet Pipeline failed Details ci/woodpecker/push/server-lint Pipeline was successful Details ci/woodpecker/push/server-test Pipeline was successful Details Reviewed-on: #95	2026-06-29 18:00:14 +00:00
Clippy Bot	23827c613e	test(client-auth): update metadata test to reflect frozen-metadata behavior Some checks failed ci/woodpecker/pr/server-audit Pipeline failed Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline was successful Details ci/woodpecker/pr/server-test Pipeline was successful Details ci/woodpecker/pr/useragent-analyze Pipeline failed Details	2026-06-28 12:06:06 +02:00
Clippy Bot	8381b68a52	Merge branch 'main' into zeroized-bootstrap-token Some checks failed ci/woodpecker/pr/server-audit Pipeline failed Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline was successful Details ci/woodpecker/pr/server-test Pipeline failed Details	2026-06-27 13:25:27 +02:00
Clippy Bot	022003ac5e	fix: lints Some checks failed ci/woodpecker/pr/server-audit Pipeline failed Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline was successful Details ci/woodpecker/pr/server-test Pipeline failed Details	2026-06-25 20:09:18 +02:00
CleverWild	00ddf99d77	fix!: protect evm_wallet integrity and bind key ciphertext to wallet address Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-test Pipeline failed Details Three independent failures allowed an offline attacker with DB write access to sign transactions using a different wallet's private key: 1. evm_wallet had no HMAC envelope — aead_encrypted_id could be swapped silently. 2. AEAD used a static tag as AAD — any valid ciphertext decrypted as any wallet key. 3. No post-decryption check that the derived address matched the requested wallet. Fix: sign_entity covers (address, aead_encrypted_id) in a single transaction; CreateNew/Decrypt take caller-provided AAD (wallet address bytes); after decryption signer.address() is verified against the requested wallet address.	2026-06-22 17:53:34 +02:00
CleverWild	b7ab5c79b7	fix(client-auth): freeze client metadata after initial operator approval Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-test Pipeline failed Details	2026-06-22 16:07:58 +02:00
CleverWild	b8e092b9d7	fix(operator): bind sign-transaction to operator-approved client set Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-test Pipeline was successful Details	2026-06-22 15:58:40 +02:00
CleverWild	9c9dc1fbb5	fix(integrity): return AttestationStatus::Unavailable for key version mismatch Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-test Pipeline was successful Details	2026-06-22 15:50:43 +02:00
CleverWild	77bf19f99e	fix(wallet): delete access entries by entry ID instead of wallet ID Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-test Pipeline was successful Details	2026-06-22 14:55:32 +02:00
CleverWild	f0456157d5	security(bootstrap): use SafeCell for token storage instead of zeroize Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-test Pipeline was successful Details	2026-06-19 22:53:28 +02:00
CleverWild	c12c12d73e	fix(UA): signing endpoint accepts arbitrary `client_id` Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-test Pipeline failed Details	2026-06-19 22:21:48 +02:00
CleverWild	670448292a	security: feat unseal and bootstrap handshake brute-force protection Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-test Pipeline failed Details	2026-06-18 21:16:38 +02:00
CleverWild	85f27d8f09	fix(bootstrap): token persists on disk with weak file permissions #59 Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline failed Details ci/woodpecker/pr/server-test Pipeline failed Details	2026-06-18 20:59:24 +02:00
CleverWild	32ceb27d77	security(server): use SysRng directly for bootstrap token generation Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline was successful Details ci/woodpecker/pr/server-test Pipeline failed Details Replace make_rng()/StdRng with UnwrapErr(SysRng) to eliminate the PRNG intermediate layer and make OS entropy derivation explicit and unambiguous. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-18 19:30:31 +02:00
CleverWild	dc03923c24	security(memory): zeroization of bootstrap token Some checks failed ci/woodpecker/pr/server-audit Pipeline was successful Details ci/woodpecker/pr/server-vet Pipeline failed Details ci/woodpecker/pr/server-lint Pipeline was successful Details ci/woodpecker/pr/server-test Pipeline failed Details	2026-06-18 17:16:06 +02:00