diff --git a/package.json b/package.json
index ce1a114..ae146b7 100644
--- a/package.json
+++ b/package.json
@@ -43,7 +43,7 @@
     "pg": "8.23.0",
     "reflect-metadata": "0.2.2",
     "rxjs": "7.8.2",
-    "tc-core-library-js": "https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6"
+    "tc-core-library-js": "https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c2df92b2227089909ab6e229df0ec6b658bb431a"
   },
   "devDependencies": {
     "@eslint/js": "9.39.2",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index ee60c90..81c3809 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -82,8 +82,8 @@ importers:
         specifier: 7.8.2
         version: 7.8.2
       tc-core-library-js:
-        specifier: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6
-        version: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6(supports-color@7.2.0)
+        specifier: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c2df92b2227089909ab6e229df0ec6b658bb431a
+        version: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c2df92b2227089909ab6e229df0ec6b658bb431a(supports-color@7.2.0)
     devDependencies:
       '@eslint/js':
         specifier: 9.39.2
@@ -2647,9 +2647,9 @@ packages:
   swagger-ui-dist@5.32.8:
     resolution: {integrity: sha512-dgMdWXIgnI4zX4OPhKEdWnlDODbgm8W3AX0Ivn/BBqcUh6xZsBxhZMnvk6DJyRz1BTrj8dPxtarmEGgkz30oyA==}
 
-  tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6:
-    resolution: {tarball: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6}
-    version: 4.0.0-rc.2
+  tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c2df92b2227089909ab6e229df0ec6b658bb431a:
+    resolution: {gitHosted: true, integrity: sha512-n+4KUOeV4LEIsTI/R216dBc6bUkbSyO/2O0LpoY3Hk7eqKsRQFUHloB3y0hfK/v1rzf8qYQxTdv8ikeRGBn4pQ==, tarball: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c2df92b2227089909ab6e229df0ec6b658bb431a}
+    version: 4.0.0-rc.2.1
     engines: {node: '>=22.13'}
 
   thread-stream@3.2.0:
@@ -5452,7 +5452,7 @@ snapshots:
     dependencies:
       '@scarf/scarf': 1.4.0
 
-  tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6(supports-color@7.2.0):
+  tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/c2df92b2227089909ab6e229df0ec6b658bb431a(supports-color@7.2.0):
     dependencies:
       '@types/jsonwebtoken': 9.0.10
       jsonwebtoken: 9.0.3
diff --git a/test/auth-rs256.spec.ts b/test/auth-rs256.spec.ts
index 1fa27b0..c4fdda6 100644
--- a/test/auth-rs256.spec.ts
+++ b/test/auth-rs256.spec.ts
@@ -32,6 +32,7 @@ function browserToken(
 ) {
   const now = Math.floor(Date.now() / 1000);
   const payload = {
+    emailVerified: true,
     [`${namespace}roles`]: ['administrator', 'Topcoder User'],
     [`${namespace}userId`]: '12345',
     iss: issuer,
@@ -114,7 +115,7 @@ describe('reports directory with the shared Topcoder authenticator', () => {
 
   it('still accepts legacy HS256 administrators on the same deployment', async () => {
     const token = jwt.sign(
-      { userId: '12345', roles: ['Administrator'] },
+      { emailVerified: true, userId: '12345', roles: ['Administrator'] },
       testSecret,
       {
         algorithm: 'HS256',
@@ -129,6 +130,9 @@ describe('reports directory with the shared Topcoder authenticator', () => {
   });
 
   it.each([
+    { emailVerified: undefined },
+    { emailVerified: false },
+    { emailVerified: 'true' },
     { exp: 1 },
     { iss: 'https://untrusted.example/' },
     { exp: undefined },
@@ -159,6 +163,7 @@ describe('reports directory with the shared Topcoder authenticator', () => {
 
   it('authorizes an RS256 machine by scopes rather than administrator roles', async () => {
     const machine = {
+      emailVerified: undefined,
       sub: 'client@clients',
       gty: 'client-credentials',
       azp: 'client',
diff --git a/test/auth.spec.ts b/test/auth.spec.ts
index 731569f..a8e028e 100644
--- a/test/auth.spec.ts
+++ b/test/auth.spec.ts
@@ -29,6 +29,7 @@ async function authenticate(
   const { SignJWT } = await import('jose');
   const now = Math.floor(Date.now() / 1000);
   const jwt = await new SignJWT({
+    emailVerified: true,
     userId: '12345',
     roles: ['Administrator'],
     iss: 'https://api.topcoder-dev.com',
diff --git a/test/fixtures.ts b/test/fixtures.ts
index 0a1c4cb..cb79c72 100644
--- a/test/fixtures.ts
+++ b/test/fixtures.ts
@@ -28,7 +28,7 @@ export function testConfig() {
  */
 export async function token(claims: Record<string, unknown>) {
   const { SignJWT } = await import('jose');
-  return new SignJWT(claims)
+  return new SignJWT({ emailVerified: true, ...claims })
     .setProtectedHeader({ alg: 'HS256' })
     .setSubject('test-user')
     .setIssuer('https://forms.test')
diff --git a/test/forms.integration.spec.ts b/test/forms.integration.spec.ts
index 59e55de..b2c6362 100644
--- a/test/forms.integration.spec.ts
+++ b/test/forms.integration.spec.ts
@@ -1294,7 +1294,7 @@ describe('forms API with real PostgreSQL', () => {
         algorithm: 'HS384',
       },
     ]) {
-      const bad = await new SignJWT(claims)
+      const bad = await new SignJWT({ emailVerified: true, ...claims })
         .setProtectedHeader({ alg: settings.algorithm })
         .setSubject('test-user')
         .setIssuer(settings.issuer)