diff --git a/appview/attest/attest.go b/appview/attest/attest.go
index ab78983..5f760c3 100644
--- a/appview/attest/attest.go
+++ b/appview/attest/attest.go
@@ -102,9 +102,12 @@ func Validate(attestationRaw, clientDataHash []byte, appID string) (*Result, err
 	}
 
 	// Verify the chain against Apple's root CA.
+	// KeyUsages must be set to Any because Apple's App Attest certificates
+	// do not carry the ServerAuth usage that Go's x509.Verify defaults to.
 	if _, err := credCert.Verify(x509.VerifyOptions{
 		Roots:         appleRootPool,
 		Intermediates: intermediates,
+		KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageAny},
 	}); err != nil {
 		return nil, fmt.Errorf("x5c chain verification failed: %w", err)
 	}