diff --git a/pkg/services/auth/idimpl/service.go b/pkg/services/auth/idimpl/service.go
index d0307bda5e5..8d05d88ca84 100644
--- a/pkg/services/auth/idimpl/service.go
+++ b/pkg/services/auth/idimpl/service.go
@@ -108,7 +108,7 @@ func (s *Service) SignIdentity(ctx context.Context, id identity.Requester) (stri
 		}
 
 		extracted := auth.IDClaims{}
-		// We don't need to verify the signature here, we are only intrested in checking
+		// We don't need to verify the signature here, we are only interested in checking
 		// when the token expires.
 		if err := parsed.UnsafeClaimsWithoutVerification(&extracted); err != nil {
 			s.metrics.failedTokenSigningCounter.Inc()
diff --git a/pkg/services/auth/idimpl/signer.go b/pkg/services/auth/idimpl/signer.go
index e69a8422b48..0814d671f75 100644
--- a/pkg/services/auth/idimpl/signer.go
+++ b/pkg/services/auth/idimpl/signer.go
@@ -54,7 +54,10 @@ func (s *LocalSigner) getSigner(ctx context.Context) (jose.Signer, error) {
 	}
 
 	signer, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.ES256, Key: key}, &jose.SignerOptions{
-		ExtraHeaders: map[jose.HeaderKey]any{headerKeyID: id},
+		ExtraHeaders: map[jose.HeaderKey]any{
+			headerKeyID:     id,
+			jose.HeaderType: "jwt",
+		},
 	})
 
 	if err != nil {