diff --git a/src/auth/jwks.ts b/src/auth/jwks.ts
index 8a282fc..fec3df9 100644
--- a/src/auth/jwks.ts
+++ b/src/auth/jwks.ts
@@ -8,8 +8,9 @@ import { currentLog } from "../logger.ts";
 // (or re-reads a mounted file), caches for a TTL, and reloads once on a `kid` miss so a rotated-
 // in key is picked up without a restart (README: zero-downtime rotation). `createJwksProvider`
 // picks the right one from the configured URL scheme and primes it at boot (fail loud).
-// node:crypto exports the JWK type only under webcrypto since @types/node 26.
-export type JsonWebKey = webcrypto.JsonWebKey;
+// node:crypto exports the JWK type only under webcrypto since @types/node 26, and that type lacks
+// the `kid` a JWKS selects a key by.
+export type JsonWebKey = webcrypto.JsonWebKey & { kid?: string };
 
 export interface JwksProvider {
   getKey(kid: string | undefined): Promise<JsonWebKey | null>;