diff --git a/examples/bench_nc_session.rs b/examples/bench_nc_session.rs
index 01077915..5d7aed13 100644
--- a/examples/bench_nc_session.rs
+++ b/examples/bench_nc_session.rs
@@ -122,6 +122,7 @@ fn fixture_user(id: uuid::Uuid) -> CurrentUser {
         username: Arc::from("alice.longname"),
         email: Arc::from("alice.longname@example.com"),
         role: smol_str::SmolStr::new_static("user"),
+        dpop_jkt: None,
     }
 }
 
diff --git a/examples/bench_round10_micro.rs b/examples/bench_round10_micro.rs
index 6e09eb41..8b884d8a 100644
--- a/examples/bench_round10_micro.rs
+++ b/examples/bench_round10_micro.rs
@@ -158,6 +158,7 @@ fn section_identity(iters: u64) {
         username: Arc::from("alice.longname"),
         email: Arc::from("alice.longname@example.com"),
         role: "user".to_string(),
+        dpop_jkt: None,
     });
 
     let (bn, ba) = measure("BEFORE String clones + role to_string", iters, || {
@@ -171,6 +172,7 @@ fn section_identity(iters: u64) {
             username: Arc::clone(&black_box(&new_claims).username),
             email: Arc::clone(&new_claims.email),
             role,
+            dpop_jkt: None,
         })
     });
 
@@ -181,6 +183,7 @@ fn section_identity(iters: u64) {
         username: Arc::clone(&new_claims.username),
         email: Arc::clone(&new_claims.email),
         role: SmolStr::new_static("user"),
+        dpop_jkt: None,
     });
     assert_eq!(old.username, *new.username);
     assert_eq!(old.email, *new.email);
diff --git a/src/application/services/auth_application_service.rs b/src/application/services/auth_application_service.rs
index 533c33b5..31abe677 100644
--- a/src/application/services/auth_application_service.rs
+++ b/src/application/services/auth_application_service.rs
@@ -4495,6 +4495,7 @@ mod phase4_gate_integration_tests {
         svc.login(crate::application::dtos::user_dto::LoginDto {
             username: email.clone(),
             password: "s3cret-passphrase".to_string(),
+            dpop_jkt: None,
         })
         .await
         .expect("baseline legacy login must succeed");
@@ -4512,6 +4513,7 @@ mod phase4_gate_integration_tests {
             .login(crate::application::dtos::user_dto::LoginDto {
                 username: email.clone(),
                 password: "s3cret-passphrase".to_string(),
+                dpop_jkt: None,
             })
             .await
             .expect_err("legacy login must be refused post-migration");
@@ -4535,6 +4537,7 @@ mod phase4_gate_integration_tests {
             .login(crate::application::dtos::user_dto::LoginDto {
                 username: email.clone(),
                 password: "wrong-password".to_string(),
+                dpop_jkt: None,
             })
             .await
             .expect_err("wrong password must still fail");
@@ -4551,6 +4554,7 @@ mod phase4_gate_integration_tests {
         svc.login(crate::application::dtos::user_dto::LoginDto {
             username: email,
             password: "s3cret-passphrase".to_string(),
+            dpop_jkt: None,
         })
         .await
         .expect("legacy login must succeed again after admin clear_registration");
diff --git a/src/interfaces/middleware/dpop.rs b/src/interfaces/middleware/dpop.rs
index 60df48ef..1b33c24c 100644
--- a/src/interfaces/middleware/dpop.rs
+++ b/src/interfaces/middleware/dpop.rs
@@ -500,13 +500,19 @@ mod tests {
 
     #[test]
     fn content_serve_matches_thumbnail() {
-        assert!(get("/files/8f8e4390-1234-4a5b-8c9d-abcdef012345/thumbnail/icon"));
-        assert!(get("/files/8f8e4390-1234-4a5b-8c9d-abcdef012345/thumbnail/large"));
+        assert!(get(
+            "/files/8f8e4390-1234-4a5b-8c9d-abcdef012345/thumbnail/icon"
+        ));
+        assert!(get(
+            "/files/8f8e4390-1234-4a5b-8c9d-abcdef012345/thumbnail/large"
+        ));
     }
 
     #[test]
     fn content_serve_matches_folder_zip() {
-        assert!(get("/folders/8f8e4390-1234-4a5b-8c9d-abcdef012345/download"));
+        assert!(get(
+            "/folders/8f8e4390-1234-4a5b-8c9d-abcdef012345/download"
+        ));
     }
 
     #[test]
@@ -530,7 +536,9 @@ mod tests {
         // Discovery endpoints (children, by-hash, search) MUST NOT be
         // allowlisted — that's the whole security argument. Attacker
         // needs to already know the UUID; can't enumerate.
-        assert!(!get("/folders/8f8e4390-1234-4a5b-8c9d-abcdef012345/children"));
+        assert!(!get(
+            "/folders/8f8e4390-1234-4a5b-8c9d-abcdef012345/children"
+        ));
         assert!(!get("/files/by-hash"));
         assert!(!get("/search"));
         assert!(!get("/auth/me"));