diff --git a/Sources/PediFoods/Services/GuestSessionService.swift b/Sources/PediFoods/Services/GuestSessionService.swift
index 9206983..411bace 100644
--- a/Sources/PediFoods/Services/GuestSessionService.swift
+++ b/Sources/PediFoods/Services/GuestSessionService.swift
@@ -113,6 +113,15 @@ actor GuestSessionService {
                 // other error (network blip, timeout, decode issue) must
                 // NOT wipe a perfectly valid registered key.
                 store.appAttestKeyId = nil
+            } catch let error as DCError {
+                // DeviceCheck itself rejects the key locally (e.g. the app
+                // was reinstalled and the Secure Enclave key backing this
+                // keyId no longer exists) - distinct from the server
+                // rejecting it, but equally unrecoverable without a fresh
+                // key. Without this, generateAssertion fails the same way
+                // forever since appAttestKeyId is never cleared.
+                print("[GuestSessionService] existing key rejected locally, re-attesting with a fresh key: \(error)")
+                store.appAttestKeyId = nil
             }
         }