diff --git a/internal/federationdomain/endpoints/token/token_handler_test.go b/internal/federationdomain/endpoints/token/token_handler_test.go
index 9e2a0cb39..7a41a4484 100644
--- a/internal/federationdomain/endpoints/token/token_handler_test.go
+++ b/internal/federationdomain/endpoints/token/token_handler_test.go
@@ -1916,7 +1916,7 @@ func TestTokenEndpointTokenExchange(t *testing.T) { // tests for grant_type "urn
 
 			// Parse the returned token.
 			actualIDToken := parsedResponseBody["access_token"].(string)
-			parsedJWT, err := jose.ParseSigned(actualIDToken, []jose.SignatureAlgorithm{jose.ES256})
+			parsedJWT, err := jose.ParseSignedCompact(actualIDToken, []jose.SignatureAlgorithm{jose.ES256})
 			require.NoError(t, err)
 			var tokenClaims map[string]any
 			require.NoError(t, json.Unmarshal(parsedJWT.UnsafePayloadWithoutVerification(), &tokenClaims))
diff --git a/internal/testutil/oidctestutil/verify_id_token.go b/internal/testutil/oidctestutil/verify_id_token.go
index 050058567..3ae792365 100644
--- a/internal/testutil/oidctestutil/verify_id_token.go
+++ b/internal/testutil/oidctestutil/verify_id_token.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package oidctestutil
@@ -24,7 +24,7 @@ func newStaticKeySet(publicKey crypto.PublicKey) coreosoidc.KeySet {
 }
 
 func (s *staticKeySet) VerifySignature(_ context.Context, jwt string) ([]byte, error) {
-	jws, err := jose.ParseSigned(jwt, []jose.SignatureAlgorithm{jose.ES256})
+	jws, err := jose.ParseSignedCompact(jwt, []jose.SignatureAlgorithm{jose.ES256})
 	if err != nil {
 		return nil, fmt.Errorf("oidc: malformed jwt: %w", err)
 	}
diff --git a/internal/upstreamoidc/upstreamoidc_test.go b/internal/upstreamoidc/upstreamoidc_test.go
index 8ecda3f86..0e6724582 100644
--- a/internal/upstreamoidc/upstreamoidc_test.go
+++ b/internal/upstreamoidc/upstreamoidc_test.go
@@ -1532,7 +1532,7 @@ func mockVerifier() *coreosoidc.IDTokenVerifier {
 	mockKeySet.EXPECT().VerifySignature(gomock.Any(), gomock.Any()).
 		AnyTimes().
 		DoAndReturn(func(ctx context.Context, jwt string) ([]byte, error) {
-			jws, err := jose.ParseSigned(jwt, []jose.SignatureAlgorithm{jose.ES256, jose.RS256})
+			jws, err := jose.ParseSignedCompact(jwt, []jose.SignatureAlgorithm{jose.ES256, jose.RS256})
 			if err != nil {
 				return nil, err
 			}
diff --git a/test/integration/cli_test.go b/test/integration/cli_test.go
index 5883f8c97..73fa839b7 100644
--- a/test/integration/cli_test.go
+++ b/test/integration/cli_test.go
@@ -1,4 +1,4 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 package integration
 
@@ -194,7 +194,7 @@ func TestCLILoginOIDC_Browser(t *testing.T) {
 
 	// Assert some properties about the token, which should be a valid JWT.
 	require.NotEmpty(t, credOutput.Status.Token)
-	jws, err := jose.ParseSigned(credOutput.Status.Token, []jose.SignatureAlgorithm{jose.ES256, jose.RS256})
+	jws, err := jose.ParseSignedCompact(credOutput.Status.Token, []jose.SignatureAlgorithm{jose.ES256, jose.RS256})
 	require.NoError(t, err)
 	claims := map[string]any{}
 	require.NoError(t, json.Unmarshal(jws.UnsafePayloadWithoutVerification(), &claims))