diff --git a/.cspell/custom-words.txt b/.cspell/custom-words.txt
index ce73c361..cd6dd6fa 100644
--- a/.cspell/custom-words.txt
+++ b/.cspell/custom-words.txt
@@ -185,3 +185,5 @@ XVCJ
 Yapily
 Zalopay
 Zalora
+sdjwt
+SDJWT
diff --git a/code/sdk/python/ap2/sdk/sdjwt/kb_sd_jwt.py b/code/sdk/python/ap2/sdk/sdjwt/kb_sd_jwt.py
index 35c709b3..6773acdf 100644
--- a/code/sdk/python/ap2/sdk/sdjwt/kb_sd_jwt.py
+++ b/code/sdk/python/ap2/sdk/sdjwt/kb_sd_jwt.py
@@ -125,13 +125,16 @@ def verify(
     # them into inline dicts so the cnf check below works correctly.
     _resolve_delegate_payload(payload, token)
     common.verify_binding(payload, prev_token)
-    if typ in TYP_TERMINAL:
-        common.verify_expected_claims(
-            payload,
-            expected_aud=expected_aud,
-            expected_nonce=expected_nonce,
-            token_label='KB-SD-JWT',
-        )
+    # aud/nonce checks apply to every hop when the caller binds them, not just
+    # the terminal one: an intermediate hop presented to the wrong recipient
+    # must fail too. (Mandatory presence of expected_aud/expected_nonce on
+    # terminal hops that carry those claims is a separate follow-up.)
+    common.verify_expected_claims(
+        payload,
+        expected_aud=expected_aud,
+        expected_nonce=expected_nonce,
+        token_label='KB-SD-JWT',
+    )
     has_cnf = _delegate_payload_has_cnf(payload)
     if typ in TYP_TERMINAL and has_cnf:
         raise ValueError("Terminal KB-SD-JWT MUST NOT carry a 'cnf' claim")