diff --git a/crates/tranquil-api/src/server/passkey_account.rs b/crates/tranquil-api/src/server/passkey_account.rs
index 2780da6..33d96b9 100644
--- a/crates/tranquil-api/src/server/passkey_account.rs
+++ b/crates/tranquil-api/src/server/passkey_account.rs
@@ -492,7 +492,7 @@ pub async fn complete_passkey_setup(
             }
         };
 
-    let passkey = match webauthn.finish_registration(&credential, &reg_state) {
+    let security_key = match webauthn.finish_registration(&credential, &reg_state) {
         Ok(sk) => sk,
         Err(e) => {
             warn!("Passkey registration failed: {:?}", e);
@@ -500,11 +500,11 @@ pub async fn complete_passkey_setup(
         }
     };
 
-    let credential_id = passkey.cred_id().to_vec();
-    let public_key = match serde_json::to_vec(&passkey) {
+    let credential_id = security_key.cred_id().to_vec();
+    let public_key = match serde_json::to_vec(&security_key) {
         Ok(pk) => pk,
         Err(e) => {
-            error!("Error serializing passkey: {:?}", e);
+            error!("Error serializing security key: {:?}", e);
             return Err(ApiError::InternalError(None));
         }
     };
diff --git a/crates/tranquil-api/src/server/passkeys.rs b/crates/tranquil-api/src/server/passkeys.rs
index d79611c..b683a9f 100644
--- a/crates/tranquil-api/src/server/passkeys.rs
+++ b/crates/tranquil-api/src/server/passkeys.rs
@@ -104,10 +104,11 @@ pub async fn finish_passkey_registration(
         .log_db_err("loading registration state")?
         .ok_or(ApiError::NoRegistrationInProgress)?;
 
-    let reg_state: PasskeyRegistration = serde_json::from_str(&reg_state_json).map_err(|e| {
-        error!("Failed to deserialize registration state: {:?}", e);
-        ApiError::InternalError(None)
-    })?;
+    let reg_state: SecurityKeyRegistration =
+        serde_json::from_str(&reg_state_json).map_err(|e| {
+            error!("Failed to deserialize registration state: {:?}", e);
+            ApiError::InternalError(None)
+        })?;
 
     let credential: RegisterPublicKeyCredential = serde_json::from_value(input.credential)
         .map_err(|e| {
diff --git a/crates/tranquil-api/src/server/reauth.rs b/crates/tranquil-api/src/server/reauth.rs
index b4ae82f..154f958 100644
--- a/crates/tranquil-api/src/server/reauth.rs
+++ b/crates/tranquil-api/src/server/reauth.rs
@@ -159,7 +159,7 @@ pub async fn reauth_passkey_start(
         return Err(ApiError::NoPasskeys);
     }
 
-    let passkeys: Vec<webauthn_rs::prelude::Passkey> = stored_passkeys
+    let passkeys: Vec<webauthn_rs::prelude::SecurityKey> = stored_passkeys
         .iter()
         .filter_map(|sp| serde_json::from_slice(&sp.public_key).ok())
         .collect();
@@ -216,7 +216,7 @@ pub async fn reauth_passkey_finish(
         .log_db_err("loading authentication state")?
         .ok_or(ApiError::NoChallengeInProgress)?;
 
-    let auth_state: webauthn_rs::prelude::PasskeyAuthentication =
+    let auth_state: webauthn_rs::prelude::SecurityKeyAuthentication =
         serde_json::from_str(&auth_state_json).map_err(|e| {
             error!("Failed to deserialize authentication state: {:?}", e);
             ApiError::InternalError(None)
diff --git a/crates/tranquil-oauth-server/src/endpoints/authorize/passkey.rs b/crates/tranquil-oauth-server/src/endpoints/authorize/passkey.rs
index ad1aab3..d114c20 100644
--- a/crates/tranquil-oauth-server/src/endpoints/authorize/passkey.rs
+++ b/crates/tranquil-oauth-server/src/endpoints/authorize/passkey.rs
@@ -327,7 +327,7 @@ async fn passkey_start_named(
             .into_response();
     }
 
-    let passkeys: Vec<webauthn_rs::prelude::Passkey> = stored_passkeys
+    let passkeys: Vec<webauthn_rs::prelude::SecurityKey> = stored_passkeys
         .iter()
         .filter_map(|sp| serde_json::from_slice(&sp.public_key).ok())
         .collect();
@@ -714,7 +714,7 @@ async fn passkey_finish_named(
             ).into_response()
         })?;
 
-    let auth_state: webauthn_rs::prelude::PasskeyAuthentication =
+    let auth_state: webauthn_rs::prelude::SecurityKeyAuthentication =
         serde_json::from_str(&auth_state_json).map_err(|e| {
             tracing::error!(error = %e, "Failed to deserialize authentication state");
             (
@@ -972,7 +972,7 @@ pub async fn authorize_passkey_start(
             .into_response();
     }
 
-    let passkeys: Vec<webauthn_rs::prelude::Passkey> = stored_passkeys
+    let passkeys: Vec<webauthn_rs::prelude::SecurityKey> = stored_passkeys
         .iter()
         .filter_map(|sp| serde_json::from_slice(&sp.public_key).ok())
         .collect();
@@ -1146,7 +1146,7 @@ pub async fn authorize_passkey_finish(
         }
     };
 
-    let auth_state: webauthn_rs::prelude::PasskeyAuthentication = match serde_json::from_str(
+    let auth_state: webauthn_rs::prelude::SecurityKeyAuthentication = match serde_json::from_str(
         &auth_state_json,
     ) {
         Ok(s) => s,
diff --git a/crates/tranquil-pds/src/auth/webauthn.rs b/crates/tranquil-pds/src/auth/webauthn.rs
index 3c25dc7..e8ed4ec 100644
--- a/crates/tranquil-pds/src/auth/webauthn.rs
+++ b/crates/tranquil-pds/src/auth/webauthn.rs
@@ -43,11 +43,11 @@ impl WebAuthnConfig {
         username: &str,
         display_name: &str,
         exclude_credentials: Vec<CredentialID>,
-    ) -> Result<(CreationChallengeResponse, PasskeyRegistration), WebauthnError> {
+    ) -> Result<(CreationChallengeResponse, SecurityKeyRegistration), WebauthnError> {
         let user_unique_id = Uuid::new_v5(&Uuid::NAMESPACE_OID, user_id.as_bytes());
 
         self.webauthn
-            .start_passkey_registration(
+            .start_securitykey_registration(
                 user_unique_id,
                 username,
                 display_name,
@@ -56,6 +56,8 @@ impl WebAuthnConfig {
                 } else {
                     Some(exclude_credentials)
                 },
+                None,
+                None,
             )
             .map(|(mut ccr, state)| {
                 let sel = ccr
@@ -64,6 +66,7 @@ impl WebAuthnConfig {
                     .get_or_insert_with(AuthenticatorSelectionCriteria::default);
                 sel.resident_key = Some(ResidentKeyRequirement::Required);
                 sel.require_resident_key = true;
+                ccr.public_key.hints = None;
                 (ccr, state)
             })
             .map_err(|e| WebauthnError::RegistrationFailed(e.to_string()))
@@ -72,29 +75,33 @@ impl WebAuthnConfig {
     pub fn finish_registration(
         &self,
         reg: &RegisterPublicKeyCredential,
-        state: &PasskeyRegistration,
-    ) -> Result<Passkey, WebauthnError> {
+        state: &SecurityKeyRegistration,
+    ) -> Result<SecurityKey, WebauthnError> {
         self.webauthn
-            .finish_passkey_registration(reg, state)
+            .finish_securitykey_registration(reg, state)
             .map_err(|e| WebauthnError::RegistrationFailed(e.to_string()))
     }
 
     pub fn start_authentication(
         &self,
-        credentials: Vec<Passkey>,
-    ) -> Result<(RequestChallengeResponse, PasskeyAuthentication), WebauthnError> {
+        credentials: Vec<SecurityKey>,
+    ) -> Result<(RequestChallengeResponse, SecurityKeyAuthentication), WebauthnError> {
         self.webauthn
-            .start_passkey_authentication(&credentials)
+            .start_securitykey_authentication(&credentials)
+            .map(|(mut rcr, state)| {
+                rcr.public_key.hints = None;
+                (rcr, state)
+            })
             .map_err(|e| WebauthnError::AuthenticationFailed(e.to_string()))
     }
 
     pub fn finish_authentication(
         &self,
         auth: &PublicKeyCredential,
-        state: &PasskeyAuthentication,
+        state: &SecurityKeyAuthentication,
     ) -> Result<AuthenticationResult, WebauthnError> {
         self.webauthn
-            .finish_passkey_authentication(auth, state)
+            .finish_securitykey_authentication(auth, state)
             .map_err(|e| WebauthnError::AuthenticationFailed(e.to_string()))
     }