diff --git a/crates/tranquil-oauth-server/src/endpoints/authorize/consent.rs b/crates/tranquil-oauth-server/src/endpoints/authorize/consent.rs
index eb13b8b..336abc7 100644
--- a/crates/tranquil-oauth-server/src/endpoints/authorize/consent.rs
+++ b/crates/tranquil-oauth-server/src/endpoints/authorize/consent.rs
@@ -1,4 +1,5 @@
 use super::*;
+use tranquil_types::Nsid;
 
 #[derive(Debug, Serialize)]
 pub struct ScopeInfo {
@@ -12,7 +13,7 @@ pub struct ScopeInfo {
 
 #[derive(Debug, Serialize)]
 pub struct PermissionSetInfo {
-    pub nsid: String,
+    pub nsid: Nsid,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub aud: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
diff --git a/crates/tranquil-pds/src/oauth/permission_set_resolver.rs b/crates/tranquil-pds/src/oauth/permission_set_resolver.rs
index 20366f2..6c5062f 100644
--- a/crates/tranquil-pds/src/oauth/permission_set_resolver.rs
+++ b/crates/tranquil-pds/src/oauth/permission_set_resolver.rs
@@ -43,15 +43,15 @@ async fn resolve_one(
     nsid: &str,
     aud: Option<&str>,
 ) -> Result<ResolvedSetGroup, ResolveFailure> {
+    let parsed = Nsid::new(nsid).map_err(|_| ResolveFailure::Invalid)?;
     let key = permission_set_key(nsid, aud);
 
     if let Some(json) = cache.get(&key).await
         && let Ok(v) = serde_json::from_str::<CachedPermissionSet>(&json)
     {
-        return Ok(group_from(nsid, aud, v.scope, v.title, v.detail));
+        return Ok(group_from(parsed, aud, v.scope, v.title, v.detail));
     }
 
-    let parsed = Nsid::new(nsid).map_err(|_| ResolveFailure::Invalid)?;
     match fetch_and_expand(&parsed, aud).await {
         Ok(fetched) => {
             let stored = CachedPermissionSet {
@@ -64,21 +64,21 @@ async fn resolve_one(
                     .set(&key, &json, Duration::from_secs(PERMISSION_SET_CACHE_TTL_SECS))
                     .await;
             }
-            Ok(group_from(nsid, aud, fetched.expanded, fetched.title, fetched.detail))
+            Ok(group_from(parsed, aud, fetched.expanded, fetched.title, fetched.detail))
         }
         Err(e) => Err(map_err(&e)),
     }
 }
 
 fn group_from(
-    nsid: &str,
+    nsid: Nsid,
     aud: Option<&str>,
     scope: String,
     title: Option<String>,
     detail: Option<String>,
 ) -> ResolvedSetGroup {
     ResolvedSetGroup {
-        nsid: nsid.to_string(),
+        nsid,
         aud: aud.map(str::to_string),
         title,
         detail,
diff --git a/crates/tranquil-scopes/src/permission_set.rs b/crates/tranquil-scopes/src/permission_set.rs
index 46b7639..afd6282 100644
--- a/crates/tranquil-scopes/src/permission_set.rs
+++ b/crates/tranquil-scopes/src/permission_set.rs
@@ -40,7 +40,7 @@ pub struct FailedSet {
 
 #[derive(Debug, Clone)]
 pub struct ResolvedSetGroup {
-    pub nsid: String,
+    pub nsid: Nsid,
     pub aud: Option<String>,
     pub title: Option<String>,
     pub detail: Option<String>,
@@ -568,7 +568,7 @@ mod tests {
         let out = ExpansionOutcome {
             passthrough: vec!["atproto".into()],
             sets: vec![ResolvedSetGroup {
-                nsid: "io.atcr.authFullApp".into(),
+                nsid: Nsid::new("io.atcr.authFullApp").unwrap(),
                 aud: None,
                 title: Some("T".into()),
                 detail: None,
@@ -603,7 +603,7 @@ mod tests {
         let out = ExpansionOutcome {
             passthrough: vec!["repo:x".into()],
             sets: vec![ResolvedSetGroup {
-                nsid: "io.atcr.authFullApp".into(),
+                nsid: Nsid::new("io.atcr.authFullApp").unwrap(),
                 aud: None,
                 title: None,
                 detail: None,