diff --git a/Package.resolved b/Package.resolved
index 81fb4bf..954a998 100644
--- a/Package.resolved
+++ b/Package.resolved
@@ -7,7 +7,7 @@
       "location" : "https://tangled.org/@sparrowtek.com/CoreATProtocol",
       "state" : {
         "branch" : "main",
-        "revision" : "7c0b9e265aeda72cb9791830c45168f97048d88c"
+        "revision" : "a48471113f64de5b7c3f37be472c7832601013c1"
       }
     },
     {
@@ -15,8 +15,8 @@
       "kind" : "remoteSourceControl",
       "location" : "https://github.com/vapor/jwt-kit.git",
       "state" : {
-        "revision" : "aa60a211797306bfb05b752ad7b4bf9f0b50d898",
-        "version" : "5.4.0"
+        "revision" : "94a8b96d0ab5aae91324b68f100e3670cd908b51",
+        "version" : "5.4.1"
       }
     },
     {
@@ -60,8 +60,8 @@
       "kind" : "remoteSourceControl",
       "location" : "https://github.com/apple/swift-crypto.git",
       "state" : {
-        "revision" : "476538ccb827f2dd18efc5de754cc87d77127a47",
-        "version" : "4.4.0"
+        "revision" : "1b6b2e274e85105bfa155183145a1dcfd63331f1",
+        "version" : "4.5.0"
       }
     },
     {
diff --git a/Sources/EffemKit/EffemKit.docc/Authentication.md b/Sources/EffemKit/EffemKit.docc/Authentication.md
index 644e47f..dc5b8cf 100644
--- a/Sources/EffemKit/EffemKit.docc/Authentication.md
+++ b/Sources/EffemKit/EffemKit.docc/Authentication.md
@@ -51,19 +51,26 @@ func signIn(handle: String) async throws -> EffemAuthResult {
 
     // result.did — the user's DID
     // result.handle — the user's handle
-    // result.accessToken — bearer token (also set in APEnvironment)
-    // result.pdsEndpoint — the user's PDS URL (also set in APEnvironment)
+    // result.accessToken — bearer token (also set on ATProtoSession.shared)
+    // result.pdsEndpoint — the user's PDS URL (also set on ATProtoSession.shared)
     return result
 }
 ```
 
-After ``EffemOAuth/authenticate(identifier:authenticator:)`` completes, CoreATProtocol's `APEnvironment` is fully configured:
+When ``EffemOAuth/authenticate(identifier:authenticator:)`` returns, the OAuth flow has populated the network-side state on `ATProtoSession.shared`:
 
-- `APEnvironment.current.host` is set to the user's PDS
-- `APEnvironment.current.accessToken` holds the bearer token
-- `APEnvironment.current.dpopPrivateKey` holds the DPoP signing key
+- `ATProtoSession.shared.host` is set to the user's PDS
+- `ATProtoSession.shared.accessToken` holds the bearer token
+- `ATProtoSession.shared.refreshToken` holds the refresh token (when issued)
 
-Both ``EffemService`` and ``EffemRepoService`` are ready to use immediately.
+DPoP signing is wired up separately. Pass the OAuth client's private key into the session before making any authenticated XRPC calls — typically right after `authenticate(...)` returns:
+
+```swift
+let pem = await oauth.privateKeyPEM
+try await setDPoPPrivateKey(pem: pem)
+```
+
+This populates `ATProtoSession.shared.dpopProofSigner`, the per-session signer that owns the DPoP key and a per-origin nonce cache. Both ``EffemService`` and ``EffemRepoService`` will then sign their requests automatically.
 
 ## Provide Auth Storage
 
diff --git a/Sources/EffemKit/EffemKit.docc/GettingStarted.md b/Sources/EffemKit/EffemKit.docc/GettingStarted.md
index 4e4dc91..95e4195 100644
--- a/Sources/EffemKit/EffemKit.docc/GettingStarted.md
+++ b/Sources/EffemKit/EffemKit.docc/GettingStarted.md
@@ -60,7 +60,7 @@ func signIn(presentURL: @escaping (URL) async -> URL) async throws -> EffemAuthR
 }
 ```
 
-After authentication succeeds, CoreATProtocol's `APEnvironment` is automatically configured with the user's PDS host, access token, and DPoP keys. ``EffemRepoService`` can immediately write records — no additional setup needed.
+After authentication succeeds, the OAuth flow populates `ATProtoSession.shared` with the user's PDS host, access token, and refresh token. Wire up DPoP signing by passing the OAuth client's private key into `setDPoPPrivateKey(pem:)` (see <doc:Authentication> for the snippet). Once that's done, ``EffemRepoService`` can immediately write records.
 
 For a full walkthrough of the OAuth flow, token refresh, and session persistence, see <doc:Authentication>.