diff --git a/.changeset/eight-eyes-float.md b/.changeset/eight-eyes-float.md
index c21b010e836..6ed8c304fff 100644
--- a/.changeset/eight-eyes-float.md
+++ b/.changeset/eight-eyes-float.md
@@ -2,4 +2,4 @@
 "@atproto/jwk-jose": patch
 ---
 
-Explicit JOSE's importJWK() "alg" argument
+Improve compatibility with runtimes relying on webcrypto (by explicit JOSE's importJWK() "alg" argument).
diff --git a/.changeset/strong-mice-talk.md b/.changeset/strong-mice-talk.md
index 91974e5e435..2241147e6b5 100644
--- a/.changeset/strong-mice-talk.md
+++ b/.changeset/strong-mice-talk.md
@@ -2,4 +2,4 @@
 "@atproto/jwk": patch
 ---
 
-Allow unknown properties in JWT payload & headers
+Allow (passthrough) unknown properties in JWT payload & headers
diff --git a/packages/oauth/jwk-webcrypto/src/webcrypto-key.ts b/packages/oauth/jwk-webcrypto/src/webcrypto-key.ts
index 3508bf570b5..74dd24b379c 100644
--- a/packages/oauth/jwk-webcrypto/src/webcrypto-key.ts
+++ b/packages/oauth/jwk-webcrypto/src/webcrypto-key.ts
@@ -75,7 +75,7 @@ export class WebcryptoKey<
     return true
   }
 
-  get privateJwk(): J | undefined {
+  get privateJwk(): Readonly<J> | undefined {
     if (super.isPrivate) return this.jwk
     throw new Error('Private Webcrypto Key not exportable')
   }
diff --git a/packages/oauth/jwk/src/key.ts b/packages/oauth/jwk/src/key.ts
index 571245b1024..9d005ed12c4 100644
--- a/packages/oauth/jwk/src/key.ts
+++ b/packages/oauth/jwk/src/key.ts
@@ -24,7 +24,7 @@ export abstract class Key<J extends Jwk = Jwk> {
     return false
   }
 
-  get privateJwk(): J | undefined {
+  get privateJwk(): Readonly<J> | undefined {
     return this.isPrivate ? this.jwk : undefined
   }