diff --git a/core/conversations/src/conversation/group_v1.rs b/core/conversations/src/conversation/group_v1.rs
index c7b4cad..665a9f4 100644
--- a/core/conversations/src/conversation/group_v1.rs
+++ b/core/conversations/src/conversation/group_v1.rs
@@ -157,6 +157,19 @@ impl GroupV1Convo {
 
         let key_package_in = KeyPackageIn::tls_deserialize(&mut keypkg_bytes.as_slice())?;
         let keypkg = key_package_in.validate(provider.crypto(), ProtocolVersion::Mls10)?; //TODO: P3 - Hardcoded Protocol Version
+        // SECURITY: validate() only proves the package is well-formed and self-signed
+        // — NOT that it belongs to the signer we asked the registry for. Bind the
+        // fetched leaf's signature_key to the requested id (a signer id is
+        // hex(Ed25519 verifying key)); reject a mismatch so a malicious/compromised
+        // registry cannot insert an attacker's leaf under a victim's identity
+        // (confidentiality break + sender-attribution spoof). Bind to the key, not the
+        // spoofable credential bytes.
+        let leaf_key = hex::encode(keypkg.leaf_node().signature_key().as_slice());
+        if leaf_key != signer.as_str() {
+            return Err(ChatError::Protocol(format!(
+                "keypackage for signer {signer} is bound to a different signing key ({leaf_key})"
+            )));
+        }
         Ok(keypkg)
     }
 
diff --git a/core/conversations/src/conversation/group_v2.rs b/core/conversations/src/conversation/group_v2.rs
index f4b5d87..5a4172e 100644
--- a/core/conversations/src/conversation/group_v2.rs
+++ b/core/conversations/src/conversation/group_v2.rs
@@ -152,8 +152,24 @@ fn fetch_key_packages<S: ExternalServices>(
                 .retrieve(member.as_str())
                 .map_err(ChatError::generic)?
                 .ok_or_else(|| ChatError::generic("No key package"))?;
-            let member_id = KeyPackageIn::tls_deserialize(&mut key_package.as_slice())?
-                .validate(service_ctx.mls_provider.crypto(), ProtocolVersion::Mls10)?
+            let validated = KeyPackageIn::tls_deserialize(&mut key_package.as_slice())?
+                .validate(service_ctx.mls_provider.crypto(), ProtocolVersion::Mls10)?;
+            // SECURITY: a validated KeyPackage only proves it is well-formed and
+            // self-signed — NOT that it belongs to the signer we asked the registry
+            // for. `member_id` below is read from the package's OWN credential and was
+            // never checked equal to `member`, so a malicious/compromised registry (or
+            // a cache poisoned by an untrusted transport) can return an attacker's
+            // package for a victim's id, inserting the attacker's leaf under the
+            // victim's identity: confidentiality break + sender-attribution spoof.
+            // A signer id is hex(Ed25519 verifying key), so bind the leaf's
+            // signature_key (not the spoofable credential bytes) to the requested id.
+            let leaf_key = hex::encode(validated.leaf_node().signature_key().as_slice());
+            if leaf_key != member.as_str() {
+                return Err(ChatError::generic(format!(
+                    "key package for {member} is bound to a different signing key ({leaf_key})"
+                )));
+            }
+            let member_id = validated
                 .leaf_node()
                 .credential()
                 .serialized_content()
diff --git a/extensions/logos-delivery-rust/build.rs b/extensions/logos-delivery-rust/build.rs
index b347e1a..50d9110 100644
--- a/extensions/logos-delivery-rust/build.rs
+++ b/extensions/logos-delivery-rust/build.rs
@@ -20,13 +20,13 @@ fn main() {
     let target_os = std::env::var("CARGO_CFG_TARGET_OS").unwrap_or_default();
 
     match target_os.as_str() {
-        "macos" | "linux" => {}
+        "macos" | "linux" | "ios" => {}
         other => panic!("unsupported OS for logos-delivery transport: {other}"),
     }
 
     // Two linking modes, because dev builds and *distributable* builds want
     // opposite things out of the library's install name / soname.
-    if relocatable() {
+    if relocatable() || target_os == "ios" {
         // Distribution: link the shipped library in place and leave its
         // relocatable name (@rpath on macOS, $ORIGIN soname on Linux) intact,
         // so the consumer can copy it into its own bundle and resolve it from
@@ -51,7 +51,16 @@ fn main() {
         println!("cargo:rustc-link-search=native={out_dir}");
     }
 
-    println!("cargo:rustc-link-lib=dylib=logosdelivery");
+    if target_os == "ios" {
+        // iOS apps cannot ship loose dylibs the way an APK can, so the delivery
+        // node is linked as a static archive. rln has to be named explicitly:
+        // with no shared library there is no rpath to resolve it transitively.
+        println!("cargo:rustc-link-lib=static=logosdelivery");
+        println!("cargo:rustc-link-lib=static=rln");
+        println!("cargo:rustc-link-lib=c++");
+    } else {
+        println!("cargo:rustc-link-lib=dylib=logosdelivery");
+    }
     println!("cargo:lib_dir={}", lib_dir.display());
 }