diff --git a/crates/jacquard-oauth/src/atproto.rs b/crates/jacquard-oauth/src/atproto.rs
index 65cdc80cf..257e2568f 100644
--- a/crates/jacquard-oauth/src/atproto.rs
+++ b/crates/jacquard-oauth/src/atproto.rs
@@ -242,11 +242,7 @@ pub fn atproto_client_metadata<'m>(
         redirect_uris,
         application_type,
         token_endpoint_auth_method: Some(auth_method.into()),
-        grant_types: if keyset.is_some() {
-            Some(metadata.grant_types.into_iter().map(|v| v.into()).collect())
-        } else {
-            None
-        },
+        grant_types: Some(metadata.grant_types.into_iter().map(|v| v.into()).collect()),
         response_types: vec!["code".to_cowstr()],
         scope: Some(Scope::serialize_multiple(metadata.scopes.as_slice())),
         dpop_bound_access_tokens: Some(true),
diff --git a/crates/jacquard-oauth/src/client.rs b/crates/jacquard-oauth/src/client.rs
index de84ad1e7..0aeca2c5a 100644
--- a/crates/jacquard-oauth/src/client.rs
+++ b/crates/jacquard-oauth/src/client.rs
@@ -298,7 +298,7 @@ where
     }
 
     pub async fn restore(&self, did: &Did<'_>, session_id: &str) -> Result<OAuthSession<T, S>> {
-        self.create_session(self.registry.get(did, session_id, false).await?)
+        self.create_session(self.registry.get(did, session_id, true).await?)
             .await
     }
 
diff --git a/crates/jacquard-oauth/src/dpop.rs b/crates/jacquard-oauth/src/dpop.rs
index e06448c79..4aec885dd 100644
--- a/crates/jacquard-oauth/src/dpop.rs
+++ b/crates/jacquard-oauth/src/dpop.rs
@@ -150,7 +150,7 @@ impl<'r, C: HttpClient, N: DpopDataSource> DpopCall<'r, C, N> {
 /// Extract authorization hash from request headers
 fn extract_ath(headers: &http::HeaderMap) -> Option<CowStr<'static>> {
     headers
-        .get("Authorization")
+        .get("authorization")
         .filter(|v| v.to_str().is_ok_and(|s| s.starts_with("DPoP ")))
         .map(|auth| {
             URL_SAFE_NO_PAD
@@ -212,9 +212,9 @@ where
 
     let next_nonce = response
         .headers()
-        .get("DPoP-Nonce")
+        .get("dpop-nonce")
         .and_then(|v| v.to_str().ok())
-        .map(|c| CowStr::from(c.to_string()));
+        .map(|c| CowStr::copy_from_str(c));
     match &next_nonce {
         Some(s) if next_nonce != init_nonce => {
             store_nonce(data_source, is_to_auth_server, s.clone());
@@ -380,7 +380,7 @@ fn is_use_dpop_nonce_error_streaming(
     }
     if !is_to_auth_server && status == 401 {
         if let Some(www_auth) = headers
-            .get("WWW-Authenticate")
+            .get("www-authenticate")
             .and_then(|v| v.to_str().ok())
         {
             return www_auth.starts_with("DPoP") && www_auth.contains(r#"error="use_dpop_nonce""#);
@@ -404,7 +404,7 @@ fn is_use_dpop_nonce_error(is_to_auth_server: bool, response: &Response<Vec<u8>>
     else if response.status() == 401 {
         if let Some(www_auth) = response
             .headers()
-            .get("WWW-Authenticate")
+            .get("www-authenticate")
             .and_then(|v| v.to_str().ok())
         {
             return www_auth.starts_with("DPoP") && www_auth.contains(r#"error="use_dpop_nonce""#);
diff --git a/crates/jacquard-oauth/src/request.rs b/crates/jacquard-oauth/src/request.rs
index d60ed1739..088793d75 100644
--- a/crates/jacquard-oauth/src/request.rs
+++ b/crates/jacquard-oauth/src/request.rs
@@ -311,11 +311,10 @@ impl RequestError {
     pub fn is_permanent(&self) -> bool {
         match &self.kind {
             RequestErrorKind::NoRefreshToken => true,
-            RequestErrorKind::HttpStatusWithBody { body, .. } => {
-                body.get("error")
-                    .and_then(|e| e.as_str())
-                    .is_some_and(|e| matches!(e, "invalid_grant" | "access_denied"))
-            }
+            RequestErrorKind::HttpStatusWithBody { body, .. } => body
+                .get("error")
+                .and_then(|e| e.as_str())
+                .is_some_and(|e| matches!(e, "invalid_grant" | "access_denied")),
             _ => false,
         }
     }