diff --git a/src/auth.ts b/src/auth.ts
index 1642e6c..1534afb 100644
--- a/src/auth.ts
+++ b/src/auth.ts
@@ -12,6 +12,7 @@
  * consistent across the product (no Authentik involved).
  */
 import { betterAuth } from "better-auth";
+import { jwt } from "better-auth/plugins";
 import { oauthProvider } from "@better-auth/oauth-provider";
 import { Pool } from "pg";
 
@@ -53,6 +54,9 @@ export const auth = betterAuth({
   database: pool,
   socialProviders,
   plugins: [
+    // oauth-provider looks up the jwt plugin (for JWKS-verifiable access tokens)
+    // and errors if it isn't registered, so add it explicitly, before it.
+    jwt(),
     // Current OAuth 2.1 provider (replaces the deprecated oidc-provider).
     // Bundles the JWT plugin, so access tokens are JWTs verifiable at /jwks —
     // exactly what the MCP server needs. DCR lets Claude self-register; the