diff --git a/src/util/attestation.ts b/src/util/attestation.ts
--- a/src/util/attestation.ts
+++ b/src/util/attestation.ts
@@ -29,7 +29,7 @@
 const REFRESH_LEAD_MS = 2 * 60 * 1000
 // Small skew so a token that is about to expire is treated as unusable.
 const CLOCK_SKEW_MS = 5 * 1000
-// Max time getAttestationToken() blocks waiting on the initial handshake.
+// Max time a caller waits and one handshake attempt holds the shared lock.
 const GET_TOKEN_TIMEOUT_MS = 3 * 1000
 
 let cachedToken: CachedToken | undefined
@@ -89,6 +89,9 @@
   if (typeof token !== 'string') {
     throw new Error('attest response missing token')
   }
+  if (typeof expires !== 'number' || !Number.isFinite(expires)) {
+    throw new Error('attest response missing expires')
+  }
   cachedToken = { token, expires }
 }
 
@@ -115,7 +118,7 @@
  */
 const runHandshake = (): void => {
   if (inFlight != null) return
-  inFlight = performHandshake()
+  const handshake: Promise<void> = performHandshake()
     .then(() => {
       if (cachedToken != null) scheduleRefresh(cachedToken.expires)
     })
@@ -123,8 +126,13 @@
       console.warn('[attestation] handshake failed:', String(error))
     })
     .finally(() => {
-      inFlight = undefined
+      if (inFlight === handshake) inFlight = undefined
     })
+  inFlight = handshake
+  // A stuck native call may continue, but it must not block later attempts.
+  setTimeout(() => {
+    if (inFlight === handshake) inFlight = undefined
+  }, GET_TOKEN_TIMEOUT_MS)
 }
 
 /**

diff --git a/src/__tests__/util/attestation.test.ts b/src/__tests__/util/attestation.test.ts
--- a/src/__tests__/util/attestation.test.ts
+++ b/src/__tests__/util/attestation.test.ts
@@ -140,7 +140,7 @@
     await expect(tokenPromise).resolves.toBe('jwt-token')
   })
 
-  it('releases a hung handshake after the watchdog so a later attempt can succeed (Task 2.2)', async () => {
+  it('keeps a hung handshake locked after the watchdog', async () => {
     mockGetAttestation.mockImplementation(
       async () => await new Promise(() => {}) // never settles
     )
@@ -156,25 +156,19 @@
     await Promise.resolve()
     await Promise.resolve()
 
-    // Watchdog fires and clears the lock.
+    // The watchdog reports the hung handshake without clearing its lock.
     await jest.advanceTimersByTimeAsync(
       attestationTimingForTests.HANDSHAKE_WATCHDOG_MS
     )
 
-    // A subsequent attempt can start after the lock is released.
-    const expires = Date.now() + 10 * 60 * 1000
-    mockGetAttestation.mockResolvedValue({
-      keyId: 'key2',
-      attestation: 'att2',
-      bundleId: 'co.edgesecure.app'
-    })
-    mockSuccessfulHandshake(expires)
-
+    // A subsequent request waits on the existing handshake rather than
+    // starting overlapping native attestation work.
     const tokenPromise = getAttestationToken()
-    await Promise.resolve()
-    await Promise.resolve()
-    await Promise.resolve()
-    await expect(tokenPromise).resolves.toBe('jwt-token')
+    await jest.advanceTimersByTimeAsync(
+      attestationTimingForTests.GET_TOKEN_TIMEOUT_MS
+    )
+    await expect(tokenPromise).resolves.toBeUndefined()
+    expect(mockGetAttestation).toHaveBeenCalledTimes(1)
   })
 
   it('suppresses retries during the failure backoff window (Task 2.3)', async () => {

diff --git a/src/util/attestation.ts b/src/util/attestation.ts
--- a/src/util/attestation.ts
+++ b/src/util/attestation.ts
@@ -46,10 +46,8 @@
 const CLOCK_SKEW_MS = 5 * 1000
 // Max time getAttestationToken() blocks waiting on the initial handshake.
 const GET_TOKEN_TIMEOUT_MS = 3 * 1000
-// Watchdog: a handshake that has not settled after this long is considered
-// hung; release the lock so a later attempt can start. Sized well above a
-// slow-but-legitimate handshake so concurrent handshakes never overlap in
-// normal operation (Apple rate-limits attestation).
+// Watchdog: log when a handshake has not settled after this long. The lock
+// remains held since native attestation cannot be cancelled safely.
 const HANDSHAKE_WATCHDOG_MS = 90 * 1000
 // After a failed handshake, don't retry (and don't make gated callers wait)
 // for this long. Keeps a persistently-failing device from adding 3s of
@@ -258,12 +256,11 @@
       if (inFlight === handshake) inFlight = undefined
     })
   inFlight = handshake
-  // A hung native call must not block all future attempts. Only clear the
-  // lock if this same handshake still holds it.
+  // Do not release the lock here: the native call may still be running, and
+  // overlapping attempts can corrupt shared attestation key state.
   setTimeout(() => {
     if (inFlight === handshake) {
-      console.warn('[attestation] handshake watchdog fired; releasing lock')
-      inFlight = undefined
+      console.warn('[attestation] handshake watchdog fired; still in progress')
     }
   }, HANDSHAKE_WATCHDOG_MS)
 }

diff --git a/src/util/attestation.ts b/src/util/attestation.ts
--- a/src/util/attestation.ts
+++ b/src/util/attestation.ts
@@ -1,5 +1,6 @@
 import { NativeModules, Platform } from 'react-native'
 
+import { ENV } from '../env'
 import { fetchInfo } from './network'
 
 /**
@@ -156,7 +157,9 @@
       await EdgeAttestation.clearKey().catch(() => {})
     } catch (error) {
       // noKey / invalidKey / native failure: fall through to full attestation.
-      console.log('[attestation] assertion unavailable:', String(error))
+      if (ENV.DEBUG_VERBOSE_LOGGING) {
+        console.log('[attestation] assertion unavailable:', String(error))
+      }
     }
     // The challenge above was consumed (or expired); fetch a fresh one for
     // the fallback attestation.
@@ -188,7 +191,9 @@
       await EdgeAttestation.clearKey().catch(() => {})
     } catch (error) {
       // noKey / native failure: fall through to full attestation.
-      console.log('[attestation] assertion unavailable:', String(error))
+      if (ENV.DEBUG_VERBOSE_LOGGING) {
+        console.log('[attestation] assertion unavailable:', String(error))
+      }
     }
     // The challenge above was consumed (or expired); fetch a fresh one for
     // the fallback attestation.

diff --git a/src/util/attestation.ts b/src/util/attestation.ts
--- a/src/util/attestation.ts
+++ b/src/util/attestation.ts
@@ -150,6 +150,7 @@
         return
       }
       // Server rejected the assertion: discard the key and re-attest.
+      cachedToken = undefined
       console.warn(
         `[attestation] assertion rejected (${assertResponse.status}); re-attesting`
       )
@@ -182,6 +183,7 @@
         cacheTokenFromResponse(await assertResponse.json())
         return
       }
+      cachedToken = undefined
       console.warn(
         `[attestation] assertion rejected (${assertResponse.status}); re-attesting`
       )

diff --git a/src/util/attestation.ts b/src/util/attestation.ts
--- a/src/util/attestation.ts
+++ b/src/util/attestation.ts
@@ -124,7 +124,9 @@
  * there is nothing to do (no native module / unsupported platform). Never
  * caches directly; the caller commits the result.
  */
-const performHandshake = async (): Promise<CachedToken | undefined> => {
+const performHandshake = async (
+  generation: number
+): Promise<CachedToken | undefined> => {
   // No native module (e.g. unsupported platform / dev environment).
   if (EdgeAttestation == null) return undefined
 
@@ -163,7 +165,7 @@
       // so any previously-minted token is suspect too. Drop it now so gated
       // callers do not keep sending a token the server already rejects while
       // re-enrollment is in progress; discard the key and re-attest.
-      cachedToken = undefined
+      if (generation === handshakeGeneration) cachedToken = undefined
       console.warn(
         `[attestation] assertion rejected (${assertResponse.status}); re-attesting`
       )
@@ -197,7 +199,7 @@
       }
       // Server rejected the assertion: drop the now-suspect cached token (see
       // the iOS branch above) before discarding the key and re-attesting.
-      cachedToken = undefined
+      if (generation === handshakeGeneration) cachedToken = undefined
       console.warn(
         `[attestation] assertion rejected (${assertResponse.status}); re-attesting`
       )
@@ -265,7 +267,7 @@
   // lock released so a newer handshake can start. Tag each attempt so a stale
   // one that finally resolves cannot clobber the newer handshake's token.
   const generation = ++handshakeGeneration
-  const handshake: Promise<void> = performHandshake()
+  const handshake: Promise<void> = performHandshake(generation)
     .then(freshToken => {
       if (generation !== handshakeGeneration) return
       lastFailureAt = 0

diff --git a/ios/edge/EdgeAttestation.swift b/ios/edge/EdgeAttestation.swift
--- a/ios/edge/EdgeAttestation.swift
+++ b/ios/edge/EdgeAttestation.swift
@@ -23,7 +23,24 @@
   // assertions (no re-attestation).
   private static let keychainService = "co.edgesecure.app.appattest"
   private static let keychainAccount = "keyId"
+  // The JS watchdog can start another handshake before an older native call
+  // returns, so keep App Attest and Keychain operations serialized end-to-end.
+  private static let appAttestQueue = DispatchQueue(
+    label: "co.edgesecure.app.appattest.operations"
+  )
 
+  private func performSerialized(
+    _ operation: @escaping (@escaping () -> Void) -> Void
+  ) {
+    EdgeAttestation.appAttestQueue.async {
+      let finished = DispatchSemaphore(value: 0)
+      operation {
+        finished.signal()
+      }
+      finished.wait()
+    }
+  }
+
   private func storeKeyId(_ keyId: String) {
     clearKeyId()
     guard let data = keyId.data(using: .utf8) else { return }
@@ -87,39 +104,44 @@
       return
     }
 
-    // A fresh key is generated per handshake: an App Attest key can only be
-    // attested once, so reuse would require the assertion flow instead.
-    service.generateKey { keyId, error in
-      if let error = error {
-        reject("generateKey", error.localizedDescription, error)
-        return
-      }
-      guard let keyId = keyId else {
-        reject("generateKey", "Failed to generate an App Attest key", nil)
-        return
-      }
-
-      // The client data is the challenge's UTF-8 bytes; the server recomputes
-      // SHA256(challenge) to validate the attestation nonce.
-      let clientDataHash = Data(SHA256.hash(data: Data(challenge.utf8)))
-
-      service.attestKey(keyId, clientDataHash: clientDataHash) { attestation, error in
+    performSerialized { finish in
+      // A fresh key is generated per handshake: an App Attest key can only be
+      // attested once, so reuse would require the assertion flow instead.
+      service.generateKey { keyId, error in
         if let error = error {
-          reject("attestKey", error.localizedDescription, error)
+          reject("generateKey", error.localizedDescription, error)
+          finish()
           return
         }
-        guard let attestation = attestation else {
-          reject("attestKey", "Failed to produce an attestation object", nil)
+        guard let keyId = keyId else {
+          reject("generateKey", "Failed to generate an App Attest key", nil)
+          finish()
           return
         }
-        // Persist the key id so subsequent handshakes refresh via assertions
-        // instead of a full (rate-limited) attestation.
-        self.storeKeyId(keyId)
-        resolve([
-          "keyId": keyId,
-          "attestation": attestation.base64EncodedString(),
-          "bundleId": Bundle.main.bundleIdentifier ?? ""
-        ])
+
+        // The client data is the challenge's UTF-8 bytes; the server recomputes
+        // SHA256(challenge) to validate the attestation nonce.
+        let clientDataHash = Data(SHA256.hash(data: Data(challenge.utf8)))
+
+        service.attestKey(keyId, clientDataHash: clientDataHash) { attestation, error in
+          defer { finish() }
+          if let error = error {
+            reject("attestKey", error.localizedDescription, error)
+            return
+          }
+          guard let attestation = attestation else {
+            reject("attestKey", "Failed to produce an attestation object", nil)
+            return
+          }
+          // Persist the key id so subsequent handshakes refresh via assertions
+          // instead of a full (rate-limited) attestation.
+          self.storeKeyId(keyId)
+          resolve([
+            "keyId": keyId,
+            "attestation": attestation.base64EncodedString(),
+            "bundleId": Bundle.main.bundleIdentifier ?? ""
+          ])
+        }
       }
     }
   }
@@ -134,31 +156,36 @@
       reject("unsupported", "App Attest is not supported on this device", nil)
       return
     }
-    guard let keyId = loadKeyId() else {
-      reject("noKey", "No attested App Attest key is stored", nil)
-      return
-    }
-    let clientDataHash = Data(SHA256.hash(data: Data(challenge.utf8)))
-    DCAppAttestService.shared.generateAssertion(keyId, clientDataHash: clientDataHash) { assertion, error in
-      if let error = error as? DCError, error.code == .invalidKey {
-        // The key no longer exists (reinstall/restore); force re-attestation.
-        self.clearKeyId()
-        reject("invalidKey", "Stored App Attest key is invalid", error)
+    performSerialized { finish in
+      guard let keyId = self.loadKeyId() else {
+        reject("noKey", "No attested App Attest key is stored", nil)
+        finish()
         return
       }
-      if let error = error {
-        reject("generateAssertion", error.localizedDescription, error)
-        return
+      let clientDataHash = Data(SHA256.hash(data: Data(challenge.utf8)))
+      DCAppAttestService.shared.generateAssertion(keyId, clientDataHash: clientDataHash) {
+        assertion, error in
+        defer { finish() }
+        if let error = error as? DCError, error.code == .invalidKey {
+          // The key no longer exists (reinstall/restore); force re-attestation.
+          self.clearKeyId()
+          reject("invalidKey", "Stored App Attest key is invalid", error)
+          return
+        }
+        if let error = error {
+          reject("generateAssertion", error.localizedDescription, error)
+          return
+        }
+        guard let assertion = assertion else {
+          reject("generateAssertion", "Failed to produce an assertion", nil)
+          return
+        }
+        resolve([
+          "keyId": keyId,
+          "assertion": assertion.base64EncodedString(),
+          "bundleId": Bundle.main.bundleIdentifier ?? ""
+        ])
       }
-      guard let assertion = assertion else {
-        reject("generateAssertion", "Failed to produce an assertion", nil)
-        return
-      }
-      resolve([
-        "keyId": keyId,
-        "assertion": assertion.base64EncodedString(),
-        "bundleId": Bundle.main.bundleIdentifier ?? ""
-      ])
     }
   }
 
@@ -167,7 +194,10 @@
     _ resolve: @escaping RCTPromiseResolveBlock,
     rejecter reject: @escaping RCTPromiseRejectBlock
   ) {
-    clearKeyId()
-    resolve(nil)
+    performSerialized { finish in
+      self.clearKeyId()
+      resolve(nil)
+      finish()
+    }
   }
 }

diff --git a/android/app/src/main/java/co/edgesecure/app/EdgeAttestationModule.kt b/android/app/src/main/java/co/edgesecure/app/EdgeAttestationModule.kt
--- a/android/app/src/main/java/co/edgesecure/app/EdgeAttestationModule.kt
+++ b/android/app/src/main/java/co/edgesecure/app/EdgeAttestationModule.kt
@@ -198,16 +198,19 @@
   @ReactMethod
   fun clearKey(promise: Promise) {
     // Best-effort: force re-enrollment when the server rejects an assertion
-    // (unknown key, revoked serial, disabled app). Resolve regardless.
-    try {
-      synchronized(keystoreLock) {
-        val keyStore = KeyStore.getInstance("AndroidKeyStore")
-        keyStore.load(null)
-        keyStore.deleteEntry(KEY_ALIAS)
+    // (unknown key, revoked serial, disabled app). Keystore access can block
+    // behind key generation, so keep it off the React Native bridge thread.
+    Thread {
+      try {
+        synchronized(keystoreLock) {
+          val keyStore = KeyStore.getInstance("AndroidKeyStore")
+          keyStore.load(null)
+          keyStore.deleteEntry(KEY_ALIAS)
+        }
+      } catch (ignored: Exception) {
+        // Best effort.
       }
-    } catch (ignored: Exception) {
-      // Best effort.
-    }
-    promise.resolve(null)
+      promise.resolve(null)
+    }.start()
   }
 }

diff --git a/src/util/attestation.ts b/src/util/attestation.ts
--- a/src/util/attestation.ts
+++ b/src/util/attestation.ts
@@ -1,3 +1,4 @@
+import { asNumber, asObject, asString } from 'cleaners'
 import { NativeModules, Platform } from 'react-native'
 
 import { fetchInfo } from './network'
@@ -34,10 +35,9 @@
 const EdgeAttestation: NativeAttestation | undefined =
   NativeModules.EdgeAttestation
 
-interface CachedToken {
-  token: string
-  expires: number // epoch milliseconds
-}
+const asChallengeResponse = asObject({ challenge: asString })
+const asCachedToken = asObject({ token: asString, expires: asNumber })
+type CachedToken = ReturnType<typeof asCachedToken>
 
 // Relaunch the handshake this long before the current token expires, so a fresh
 // token is (re)fetched by the background engine well ahead of expiry.
@@ -55,6 +55,7 @@
 // for this long. Keeps a persistently-failing device from adding 3s of
 // latency to every gated request.
 const FAILURE_BACKOFF_MS = 60 * 1000
+const KEY_REJECTION_STATUSES = new Set([400, 401, 403, 404])
 
 let cachedToken: CachedToken | undefined
 let inFlight: Promise<void> | undefined
@@ -84,14 +85,26 @@
 const hasLiveToken = (): boolean =>
   cachedToken != null && Date.now() < cachedToken.expires - CLOCK_SKEW_MS
 
+const isMissingKeyError = (error: unknown): boolean => {
+  if (typeof error !== 'object' || error == null) return false
+  const code = 'code' in error ? error.code : undefined
+  const message = error instanceof Error ? error.message : undefined
+  return (
+    code === 'noKey' ||
+    code === 'invalidKey' ||
+    message === 'noKey' ||
+    message === 'invalidKey'
+  )
+}
+
 /** Obtain a single-use challenge from the info server. */
 const fetchChallenge = async (): Promise<string> => {
   const challengeResponse = await fetchInfo('v1/attest/challenge')
   if (!challengeResponse.ok) {
     throw new Error(`challenge request failed: ${challengeResponse.status}`)
   }
-  const { challenge } = await challengeResponse.json()
-  if (typeof challenge !== 'string' || challenge === '') {
+  const { challenge } = asChallengeResponse(await challengeResponse.json())
+  if (challenge === '') {
     throw new Error('challenge response missing challenge')
   }
   return challenge
@@ -106,17 +119,12 @@
  * result before it clobbers a fresher token.
  */
 const parseTokenResponse = (json: unknown): CachedToken => {
-  const { token, expires } = (json ?? {}) as {
-    token?: unknown
-    expires?: unknown
-  }
-  if (typeof token !== 'string') {
-    throw new Error('attest response missing token')
-  }
-  if (typeof expires !== 'number' || !Number.isFinite(expires)) {
+  const tokenResponse = asCachedToken(json)
+  const { expires } = tokenResponse
+  if (!Number.isFinite(expires)) {
     throw new Error('attest response missing expires')
   }
-  return { token, expires }
+  return tokenResponse
 }
 
 /**
@@ -146,11 +154,20 @@
   let challenge = await fetchChallenge()
 
   // iOS fast path: assert with the stored attested key (no Apple round
-  // trip, no new key). Falls back to full attestation when there is no
-  // stored key, the key is invalid, or the server rejects the assertion.
+  // trip, no new key). Falls back to full attestation only when there is no
+  // stored key, the key is invalid, or the server rejects the enrolled key.
   if (isIos) {
+    let native:
+      | Awaited<ReturnType<NativeAttestation['generateAssertion']>>
+      | undefined
     try {
-      const native = await EdgeAttestation.generateAssertion(challenge)
+      native = await EdgeAttestation.generateAssertion(challenge)
+    } catch (error) {
+      if (!isMissingKeyError(error)) throw error
+      console.log('[attestation] assertion unavailable:', String(error))
+      challenge = await fetchChallenge()
+    }
+    if (native != null) {
       const assertResponse = await fetchInfo('v1/attest/apple/assert', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
@@ -163,32 +180,34 @@
       if (assertResponse.ok) {
         return parseTokenResponse(await assertResponse.json())
       }
-      // Server rejected the assertion: the enrolled key is no longer trusted,
-      // so any previously-minted token is suspect too. Drop it now so gated
-      // callers do not keep sending a token the server already rejects while
-      // re-enrollment is in progress; discard the key and re-attest. Only when
-      // this is still the current handshake, so a stale (watchdog-released)
-      // attempt cannot wipe a token a newer handshake already cached.
-      if (generation === handshakeGeneration) cachedToken = undefined
+      if (!KEY_REJECTION_STATUSES.has(assertResponse.status)) {
+        throw new Error(`assert request failed: ${assertResponse.status}`)
+      }
+      if (generation !== handshakeGeneration) return undefined
+      cachedToken = undefined
       console.warn(
         `[attestation] assertion rejected (${assertResponse.status}); re-attesting`
       )
-      await EdgeAttestation.clearKey().catch(() => {})
-    } catch (error) {
-      // noKey / invalidKey / native failure: fall through to full attestation.
-      console.log('[attestation] assertion unavailable:', String(error))
+      await EdgeAttestation.clearKey()
+      challenge = await fetchChallenge()
     }
-    // The challenge above was consumed (or expired); fetch a fresh one for
-    // the fallback attestation.
-    challenge = await fetchChallenge()
   }
 
   // Android fast path: sign the challenge with the enrolled Keystore key
-  // (no new key, no RKP dependency). Falls back to full attestation when
-  // there is no stored key or the server rejects the assertion.
+  // (no new key, no RKP dependency). Falls back to full attestation only when
+  // there is no stored key or the server rejects the enrolled key.
   if (!isIos) {
+    let native:
+      | Awaited<ReturnType<NativeAttestation['signChallenge']>>
+      | undefined
     try {
-      const native = await EdgeAttestation.signChallenge(challenge)
+      native = await EdgeAttestation.signChallenge(challenge)
+    } catch (error) {
+      if (!isMissingKeyError(error)) throw error
+      console.log('[attestation] assertion unavailable:', String(error))
+      challenge = await fetchChallenge()
+    }
+    if (native != null) {
       const assertResponse = await fetchInfo('v1/attest/android/assert', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
@@ -201,21 +220,17 @@
       if (assertResponse.ok) {
         return parseTokenResponse(await assertResponse.json())
       }
-      // Server rejected the assertion: drop the now-suspect cached token (see
-      // the iOS branch above), guarded by the current generation, before
-      // discarding the key and re-attesting.
-      if (generation === handshakeGeneration) cachedToken = undefined
+      if (!KEY_REJECTION_STATUSES.has(assertResponse.status)) {
+        throw new Error(`assert request failed: ${assertResponse.status}`)
+      }
+      if (generation !== handshakeGeneration) return undefined
+      cachedToken = undefined
       console.warn(
         `[attestation] assertion rejected (${assertResponse.status}); re-attesting`
       )
-      await EdgeAttestation.clearKey().catch(() => {})
-    } catch (error) {
-      // noKey / native failure: fall through to full attestation.
-      console.log('[attestation] assertion unavailable:', String(error))
+      await EdgeAttestation.clearKey()
+      challenge = await fetchChallenge()
     }
-    // The challenge above was consumed (or expired); fetch a fresh one for
-    // the fallback attestation.
-    challenge = await fetchChallenge()
   }
 
   // 2. Produce a platform attestation bound to the challenge.

diff --git a/src/util/attestation.ts b/src/util/attestation.ts
--- a/src/util/attestation.ts
+++ b/src/util/attestation.ts
@@ -60,8 +60,9 @@
 let inFlight: Promise<void> | undefined
 let refreshTimer: ReturnType<typeof setTimeout> | undefined
 let lastFailureAt = 0
-// Monotonic id of the latest handshake attempt; a resolved handshake only
-// commits its token when its generation is still current (see runHandshake).
+// Monotonic id of the latest handshake attempt; used so a stale (watchdog-
+// released) completion cannot clobber a token a newer handshake already
+// cached (see runHandshake).
 let handshakeGeneration = 0
 
 /** Test-only: clear module state between Jest cases. */
@@ -274,7 +275,13 @@
   const generation = ++handshakeGeneration
   const handshake: Promise<void> = performHandshake(generation)
     .then(freshToken => {
-      if (generation !== handshakeGeneration) return
+      if (generation !== handshakeGeneration) {
+        // Watchdog-superseded: a newer attempt already owns the generation.
+        // Still accept a late valid JWT when nothing fresher is cached (the
+        // newer attempt may have failed and entered backoff). Never clobber
+        // a live token a newer handshake already produced.
+        if (freshToken == null || hasLiveToken()) return
+      }
       lastFailureAt = 0
       if (freshToken != null) {
         cachedToken = freshToken

diff --git a/src/util/attestation.ts b/src/util/attestation.ts
--- a/src/util/attestation.ts
+++ b/src/util/attestation.ts
@@ -175,7 +175,11 @@
       )
       await EdgeAttestation.clearKey().catch(() => {})
     } catch (error) {
-      // noKey / invalidKey / native failure: fall through to full attestation.
+      // noKey / invalidKey / native failure: the enrolled key is unusable
+      // (invalidKey also clears the stored key id natively), so drop any
+      // cached JWT before falling through to full attestation - same
+      // fail-closed semantics as a non-OK assert response above.
+      if (generation === handshakeGeneration) cachedToken = undefined
       console.log('[attestation] assertion unavailable:', String(error))
     }
     // The challenge above was consumed (or expired); fetch a fresh one for
@@ -210,7 +214,9 @@
       )
       await EdgeAttestation.clearKey().catch(() => {})
     } catch (error) {
-      // noKey / native failure: fall through to full attestation.
+      // noKey / native failure: drop any cached JWT before falling through
+      // to full attestation (see the iOS catch above).
+      if (generation === handshakeGeneration) cachedToken = undefined
       console.log('[attestation] assertion unavailable:', String(error))
     }
     // The challenge above was consumed (or expired); fetch a fresh one for

diff --git a/src/util/attestation.ts b/src/util/attestation.ts
--- a/src/util/attestation.ts
+++ b/src/util/attestation.ts
@@ -293,6 +293,14 @@
       if (generation !== handshakeGeneration) return
       lastFailureAt = Date.now()
       console.warn('[attestation] handshake failed:', String(error))
+      // Keep the background engine alive across transient failures. The timer
+      // that fired this attempt is gone, and scheduleRefresh only runs on
+      // success — without a backoff retry the loop would stall until a gated
+      // caller or app restart kicks runHandshake again.
+      if (refreshTimer != null) clearTimeout(refreshTimer)
+      refreshTimer = setTimeout(() => {
+        runHandshake()
+      }, FAILURE_BACKOFF_MS)
     })
     .finally(() => {
       if (inFlight === handshake) inFlight = undefined

diff --git a/src/util/attestation.ts b/src/util/attestation.ts
--- a/src/util/attestation.ts
+++ b/src/util/attestation.ts
@@ -273,16 +273,25 @@
 }
 
 /**
+ * Current failure backoff: base `FAILURE_BACKOFF_MS`, doubling per consecutive
+ * failure up to `MAX_BACKOFF_MS`. Shared by the background retry timer and the
+ * gated-call gate in `runHandshake` so plugin traffic cannot outpace the
+ * exponential policy.
+ */
+const failureBackoffMs = (): number =>
+  Math.min(
+    FAILURE_BACKOFF_MS * 2 ** Math.max(0, consecutiveFailures - 1),
+    MAX_BACKOFF_MS
+  )
+
+/**
  * Schedule the next handshake after a failed or hung attempt. `scheduleRefresh`
  * only runs on success, so without this the engine would sit idle until a gated
  * call or an app restart. The wait doubles with each consecutive failure up to
  * `MAX_BACKOFF_MS` to keep a hopeless device from re-attesting forever.
  */
 const scheduleRetryAfterFailure = (): void => {
-  const backoffMs = Math.min(
-    FAILURE_BACKOFF_MS * 2 ** Math.max(0, consecutiveFailures - 1),
-    MAX_BACKOFF_MS
-  )
+  const backoffMs = failureBackoffMs()
   // A cached token may still have most of its life left - a stale handshake can
   // land one while a newer attempt is failing. Never retry sooner than
   // `scheduleRefresh` would have, or a failing device would re-attest every
@@ -304,7 +313,7 @@
  */
 const runHandshake = (): void => {
   if (inFlight != null) return
-  if (Date.now() - lastFailureAt < FAILURE_BACKOFF_MS) return
+  if (Date.now() - lastFailureAt < failureBackoffMs()) return
   // A handshake whose native call hangs past the watchdog has its `inFlight`
   // lock released so a newer handshake can start. Tag each attempt so a stale
   // one that finally resolves cannot clobber a token a newer handshake already

diff --git a/ios/edge/EdgeAttestation.swift b/ios/edge/EdgeAttestation.swift
--- a/ios/edge/EdgeAttestation.swift
+++ b/ios/edge/EdgeAttestation.swift
@@ -6,11 +6,12 @@
 
 /// Native bridge for iOS App Attest (app-level attestation).
 ///
-/// Exposes two methods to JS:
+/// Exposes methods to JS:
 ///   - isSupported(): resolves true only on real devices that support App Attest
-///   - getAttestation(challenge): generates a fresh App Attest key, attests it
-///     against SHA256(challenge), and resolves { keyId, attestation }, where
-///     attestation is the base64-encoded CBOR attestation object.
+///   - getAttestation(challenge): attests a pending (or freshly generated) App
+///     Attest key against SHA256(challenge), and resolves { keyId, attestation },
+///     where attestation is the base64-encoded CBOR attestation object
+///   - generateAssertion(challenge) / clearKey(): assertion refresh and reset
 @objc(EdgeAttestation)
 class EdgeAttestation: NSObject {
   @objc static func requiresMainQueueSetup() -> Bool {
@@ -28,30 +29,35 @@
     label: "co.edgesecure.app.appattest.serial"
   )
 
-  // Keychain persistence for the attested App Attest key id. App Attest private
-  // keys live in the Secure Enclave keyed by this id; Apple recommends storing
-  // the id in the Keychain so it survives across launches and is reused for
-  // assertions (no re-attestation).
+  // Keychain persistence for App Attest key ids. App Attest private keys live
+  // in the Secure Enclave keyed by this id; Apple recommends storing the id in
+  // the Keychain so it survives across launches.
+  //
+  // `keyId` holds a successfully attested key (reused for assertions).
+  // `pendingKeyId` holds a key that was generated but not yet attested — kept
+  // across transient `attestKey` failures (e.g. serverUnavailable) so the next
+  // handshake retries with the same key instead of calling `generateKey` again.
   private static let keychainService = "co.edgesecure.app.appattest"
   private static let keychainAccount = "keyId"
+  private static let keychainPendingAccount = "pendingKeyId"
 
-  private func storeKeyId(_ keyId: String) {
-    clearKeyId()
-    guard let data = keyId.data(using: .utf8) else { return }
+  private func storeAccount(_ account: String, value: String) {
+    clearAccount(account)
+    guard let data = value.data(using: .utf8) else { return }
     let query: [String: Any] = [
       kSecClass as String: kSecClassGenericPassword,
       kSecAttrService as String: EdgeAttestation.keychainService,
-      kSecAttrAccount as String: EdgeAttestation.keychainAccount,
+      kSecAttrAccount as String: account,
       kSecValueData as String: data
     ]
     SecItemAdd(query as CFDictionary, nil)
   }
 
-  private func loadKeyId() -> String? {
+  private func loadAccount(_ account: String) -> String? {
     let query: [String: Any] = [
       kSecClass as String: kSecClassGenericPassword,
       kSecAttrService as String: EdgeAttestation.keychainService,
-      kSecAttrAccount as String: EdgeAttestation.keychainAccount,
+      kSecAttrAccount as String: account,
       kSecReturnData as String: true,
       kSecMatchLimit as String: kSecMatchLimitOne
     ]
@@ -61,15 +67,39 @@
     return String(data: data, encoding: .utf8)
   }
 
-  private func clearKeyId() {
+  private func clearAccount(_ account: String) {
     let query: [String: Any] = [
       kSecClass as String: kSecClassGenericPassword,
       kSecAttrService as String: EdgeAttestation.keychainService,
-      kSecAttrAccount as String: EdgeAttestation.keychainAccount
+      kSecAttrAccount as String: account
     ]
     SecItemDelete(query as CFDictionary)
   }
 
+  private func storeKeyId(_ keyId: String) {
+    storeAccount(EdgeAttestation.keychainAccount, value: keyId)
+  }
+
+  private func loadKeyId() -> String? {
+    loadAccount(EdgeAttestation.keychainAccount)
+  }
+
+  private func clearKeyId() {
+    clearAccount(EdgeAttestation.keychainAccount)
+  }
+
+  private func storePendingKeyId(_ keyId: String) {
+    storeAccount(EdgeAttestation.keychainPendingAccount, value: keyId)
+  }
+
+  private func loadPendingKeyId() -> String? {
+    loadAccount(EdgeAttestation.keychainPendingAccount)
+  }
+
+  private func clearPendingKeyId() {
+    clearAccount(EdgeAttestation.keychainPendingAccount)
+  }
+
   @objc(isSupported:rejecter:)
   func isSupported(
     _ resolve: @escaping RCTPromiseResolveBlock,
@@ -103,26 +133,20 @@
     EdgeAttestation.serialQueue.async {
       let done = DispatchSemaphore(value: 0)
 
-      // A fresh key is generated per handshake: an App Attest key can only be
-      // attested once, so reuse would require the assertion flow instead.
-      service.generateKey { keyId, error in
-        if let error = error {
-          reject("generateKey", error.localizedDescription, error)
-          done.signal()
-          return
-        }
-        guard let keyId = keyId else {
-          reject("generateKey", "Failed to generate an App Attest key", nil)
-          done.signal()
-          return
-        }
-
-        // The client data is the challenge's UTF-8 bytes; the server recomputes
-        // SHA256(challenge) to validate the attestation nonce.
+      // Attest `keyId` against SHA256(challenge). On success, promote the key
+      // from pending → attested so assertions can reuse it. On invalidKey,
+      // discard the pending id so the next call generates a fresh key. On
+      // other errors (notably serverUnavailable), leave the pending id so the
+      // next handshake retries attestKey with the same key — Apple's guidance.
+      let attestPending: (String) -> Void = { keyId in
         let clientDataHash = Data(SHA256.hash(data: Data(challenge.utf8)))
-
         service.attestKey(keyId, clientDataHash: clientDataHash) { attestation, error in
           defer { done.signal() }
+          if let error = error as? DCError, error.code == .invalidKey {
+            self.clearPendingKeyId()
+            reject("invalidKey", "App Attest key is invalid", error)
+            return
+          }
           if let error = error {
             reject("attestKey", error.localizedDescription, error)
             return
@@ -131,9 +155,8 @@
             reject("attestKey", "Failed to produce an attestation object", nil)
             return
           }
-          // Persist the key id so subsequent handshakes refresh via assertions
-          // instead of a full (rate-limited) attestation.
           self.storeKeyId(keyId)
+          self.clearPendingKeyId()
           resolve([
             "keyId": keyId,
             "attestation": attestation.base64EncodedString(),
@@ -142,6 +165,28 @@
         }
       }
 
+      // Retry a previously generated but unattested key when present; otherwise
+      // generate a new one and persist it before attestKey so a transient
+      // failure does not orphan the Secure Enclave key.
+      if let pendingKeyId = self.loadPendingKeyId() {
+        attestPending(pendingKeyId)
+      } else {
+        service.generateKey { keyId, error in
+          if let error = error {
+            reject("generateKey", error.localizedDescription, error)
+            done.signal()
+            return
+          }
+          guard let keyId = keyId else {
+            reject("generateKey", "Failed to generate an App Attest key", nil)
+            done.signal()
+            return
+          }
+          self.storePendingKeyId(keyId)
+          attestPending(keyId)
+        }
+      }
+
       done.wait()
     }
   }
@@ -197,6 +242,7 @@
   ) {
     EdgeAttestation.serialQueue.async {
       self.clearKeyId()
+      self.clearPendingKeyId()
       resolve(nil)
     }
   }

diff --git a/src/__tests__/util/attestation.test.ts b/src/__tests__/util/attestation.test.ts
--- a/src/__tests__/util/attestation.test.ts
+++ b/src/__tests__/util/attestation.test.ts
@@ -132,6 +132,34 @@
     await expect(tokenPromise).resolves.toBeUndefined()
   })
 
+  it('rejects attest responses with an already-past expires', async () => {
+    mockFetchInfo.mockImplementation(async (path: string) => {
+      if (path === 'v1/attest/challenge') {
+        return jsonResponse({ challenge: 'chal-1' })
+      }
+      return jsonResponse({ token: 'jwt-token', expires: Date.now() - 1 })
+    })
+
+    initAttestation()
+    const tokenPromise = getAttestationToken()
+    await jest.advanceTimersByTimeAsync(
+      attestationTimingForTests.GET_TOKEN_TIMEOUT_MS
+    )
+    await expect(tokenPromise).resolves.toBeUndefined()
+
+    // Past expiry must fail the handshake (backoff), not schedule a 0ms refresh
+    // that would tight-loop challenge/attest as fast as the network allows.
+    const attestCallsBefore = mockFetchInfo.mock.calls.filter(
+      ([path]) => path === 'v1/attest/apple' || path === 'v1/attest/android'
+    ).length
+    await jest.advanceTimersByTimeAsync(1)
+    await flush()
+    const attestCallsAfter = mockFetchInfo.mock.calls.filter(
+      ([path]) => path === 'v1/attest/apple' || path === 'v1/attest/android'
+    ).length
+    expect(attestCallsAfter).toBe(attestCallsBefore)
+  })
+
   it('caches a token when expires is a finite number (Task 2.1)', async () => {
     const expires = Date.now() + 10 * 60 * 1000
     mockSuccessfulHandshake(expires)

diff --git a/src/util/attestation.ts b/src/util/attestation.ts
--- a/src/util/attestation.ts
+++ b/src/util/attestation.ts
@@ -124,10 +124,10 @@
 /**
  * Validate an attest/assert token response. Both `token` and `expires` are
  * validated; a malformed response throws and is treated as a failed handshake
- * (a non-finite `expires` would otherwise fire `setTimeout` immediately and
- * spin the handshake loop). The parsed token is returned to the caller rather
- * than cached directly, so `runHandshake` can drop a stale (watchdog-released)
- * result before it clobbers a fresher token.
+ * (a non-finite or already-past `expires` would otherwise fire `setTimeout`
+ * immediately and spin the handshake loop). The parsed token is returned to
+ * the caller rather than cached directly, so `runHandshake` can drop a stale
+ * (watchdog-released) result before it clobbers a fresher token.
  */
 const parseTokenResponse = (json: unknown): CachedToken => {
   const { token, expires } = (json ?? {}) as {
@@ -140,6 +140,10 @@
   if (typeof expires !== 'number' || !Number.isFinite(expires)) {
     throw new Error('attest response missing expires')
   }
+  // A past expiry schedules a 0ms refresh and would tight-loop the engine.
+  if (expires <= Date.now()) {
+    throw new Error('attest response expires is in the past')
+  }
   return { token, expires }
 }