diff --git a/.cspell/custom-words.txt b/.cspell/custom-words.txt
index ce73c361..e11ba577 100644
--- a/.cspell/custom-words.txt
+++ b/.cspell/custom-words.txt
@@ -149,6 +149,7 @@ ropeproject
 RPCURL
 Rulebook
 screenreaders
+sdjwt
 setlocal
 sharedpref
 Shopcider
diff --git a/code/sdk/python/ap2/sdk/sdjwt/common.py b/code/sdk/python/ap2/sdk/sdjwt/common.py
index cdea78ae..cc540b75 100644
--- a/code/sdk/python/ap2/sdk/sdjwt/common.py
+++ b/code/sdk/python/ap2/sdk/sdjwt/common.py
@@ -83,7 +83,7 @@ def cnf_jwk(self) -> JWK | None:
         cnf = self._find_cnf()
         if isinstance(cnf, dict) and 'jwk' in cnf:
             jwk_model = JsonWebKey.model_validate(cnf['jwk'])
-            return JWK(**jwk_model.model_dump(exclude_none=True))
+            return JWK(**jwk_model.model_dump(mode='json', exclude_none=True))
         return None
 
     def _find_cnf(self) -> dict[str, Any] | None:
diff --git a/code/sdk/python/ap2/tests/kb_sd_jwt_tests.py b/code/sdk/python/ap2/tests/kb_sd_jwt_tests.py
index 7f0dc80f..1d4fdeb3 100644
--- a/code/sdk/python/ap2/tests/kb_sd_jwt_tests.py
+++ b/code/sdk/python/ap2/tests/kb_sd_jwt_tests.py
@@ -137,6 +137,27 @@ def test_verify_accepts_valid_hop(issuer_key):
     )
 
 
+def test_verify_accepts_cnf_jwk_with_use_and_alg(issuer_key):
+    """A prior hop whose ``cnf.jwk`` carries ``use`` and ``alg`` still verifies."""
+    holder = JWK.generate(kty='EC', crv='P-256', use='sig', alg='ES256')
+    assert json.loads(holder.export_public())['use'] == 'sig'
+    prev = _root_open(issuer_key, holder)
+    result = _create(
+        prev_token=prev,
+        holder_key=holder,
+        payload=sample_payment_mandate(),
+        aud='a',
+        nonce='n',
+    )
+    _verify(
+        result.sd_jwt_issuance,
+        prev,
+        issuer_key,
+        expected_aud='a',
+        expected_nonce='n',
+    )
+
+
 def test_verify_accepts_issuer_jwt_hash_mode(issuer_key):
     holder = JWK.generate(kty='EC', crv='P-256')
     prev = _root_open(issuer_key, holder)