diff --git a/auth/iam_ipa.go b/auth/iam_ipa.go
index 2cd5ea40..490d4948 100644
--- a/auth/iam_ipa.go
+++ b/auth/iam_ipa.go
@@ -19,6 +19,7 @@ import (
 	"crypto/cipher"
 	"crypto/rand"
 	"crypto/rsa"
+	"crypto/sha256"
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/base64"
@@ -168,7 +169,7 @@ func (ipa *IpaIAMService) GetUserAccount(access string) (Account, error) {
 		return account, fmt.Errorf("ipa cannot generate session key: %w", err)
 	}
 
-	encryptedKey, err := rsa.EncryptPKCS1v15(rand.Reader, ipa.kraTransportKey, session_key)
+	encryptedKey, err := rsa.EncryptOAEP(sha256.New(), rand.Reader, ipa.kraTransportKey, session_key, nil)
 	if err != nil {
 		return account, fmt.Errorf("ipa vault secret retrieval: %w", err)
 	}
diff --git a/iamapi/internal/iamutil/webidentity.go b/iamapi/internal/iamutil/webidentity.go
index e72f1cb8..4a27761c 100644
--- a/iamapi/internal/iamutil/webidentity.go
+++ b/iamapi/internal/iamutil/webidentity.go
@@ -543,11 +543,15 @@ func (k jwk) publicKey() (any, error) {
 		if err != nil {
 			return nil, fmt.Errorf("decode EC y: %w", err)
 		}
-		return &ecdsa.PublicKey{
-			Curve: curve,
-			X:     new(big.Int).SetBytes(xb),
-			Y:     new(big.Int).SetBytes(yb),
-		}, nil
+		x := new(big.Int).SetBytes(xb)
+		y := new(big.Int).SetBytes(yb)
+		keyBytes := make([]byte, 1+(curve.Params().BitSize+7)/8*2)
+		keyBytes[0] = 0x04
+		xBytes := x.FillBytes(make([]byte, (curve.Params().BitSize+7)/8))
+		yBytes := y.FillBytes(make([]byte, (curve.Params().BitSize+7)/8))
+		copy(keyBytes[1:1+len(xBytes)], xBytes)
+		copy(keyBytes[1+len(xBytes):], yBytes)
+		return ecdsa.ParseUncompressedPublicKey(curve, keyBytes)
 	default:
 		return nil, fmt.Errorf("unsupported JWK key type %q", k.Kty)
 	}