diff --git a/app/Services/WebauthnService.php b/app/Services/WebauthnService.php
index b246411..a90a5f6 100644
--- a/app/Services/WebauthnService.php
+++ b/app/Services/WebauthnService.php
@@ -143,7 +143,18 @@ class WebauthnService
             $validator = AuthenticatorAssertionResponseValidator::create($this->ceremony()->requestCeremony());
             $updated = $validator->check($source, $assertion, $options, $this->rpId(), (string) $user->id);
 
-            $model->update(['sign_count' => $updated->counter, 'last_used_at' => now()]);
+            // Re-serialize the UPDATED record so the new sign counter is also embedded in
+            // public_key — otherwise the next assertion would validate against the stale
+            // registration-time counter and clone/rollback detection would never fire.
+            $updatedSource = $updated instanceof PublicKeyCredentialSource
+                ? $updated
+                : PublicKeyCredentialSource::fromCredentialRecord($updated);
+
+            $model->update([
+                'public_key' => $serializer->serialize($updatedSource, 'json'),
+                'sign_count' => $updated->counter,
+                'last_used_at' => now(),
+            ]);
             session()->forget('webauthn.login');
 
             return true;