diff --git a/appinfo/info.xml b/appinfo/info.xml
index 31906f511e9..b356181206e 100644
--- a/appinfo/info.xml
+++ b/appinfo/info.xml
@@ -82,6 +82,7 @@
 			<step>OCA\Talk\Migration\ClearResourceAccessCache</step>
 			<step>OCA\Talk\Migration\CacheUserDisplayNames</step>
 			<step>OCA\Talk\Migration\FixLastReadMessageZero</step>
+			<step>OCA\Talk\Migration\RegenerateSignalingKeys</step>
 		</post-migration>
 	</repair-steps>
 
diff --git a/composer.json b/composer.json
index 293d11610b2..06d357cef29 100644
--- a/composer.json
+++ b/composer.json
@@ -46,7 +46,7 @@
 		"bamarni/composer-bin-plugin": "^1.8",
 		"cuyz/valinor": "^1.14",
 		"cweagans/composer-patches": "^1.7.3",
-		"firebase/php-jwt": "^6.10"
+		"firebase/php-jwt": "^7.0.2"
 	},
 	"extra": {
 		"mozart": {
diff --git a/composer.lock b/composer.lock
index 89536b96f9e..423f7127abe 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "45034e5da285b63bd5aed5eec4dfaa30",
+    "content-hash": "582ba4e7f859c5c6bacc2553c5d13e7f",
     "packages": [
         {
             "name": "bamarni/composer-bin-plugin",
@@ -187,16 +187,16 @@
         },
         {
             "name": "firebase/php-jwt",
-            "version": "v6.10.2",
+            "version": "v7.0.2",
             "source": {
                 "type": "git",
                 "url": "https://github.com/firebase/php-jwt.git",
-                "reference": "30c19ed0f3264cb660ea496895cfb6ef7ee3653b"
+                "reference": "5645b43af647b6947daac1d0f659dd1fbe8d3b65"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/firebase/php-jwt/zipball/30c19ed0f3264cb660ea496895cfb6ef7ee3653b",
-                "reference": "30c19ed0f3264cb660ea496895cfb6ef7ee3653b",
+                "url": "https://api.github.com/repos/firebase/php-jwt/zipball/5645b43af647b6947daac1d0f659dd1fbe8d3b65",
+                "reference": "5645b43af647b6947daac1d0f659dd1fbe8d3b65",
                 "shasum": ""
             },
             "require": {
@@ -244,9 +244,9 @@
             ],
             "support": {
                 "issues": "https://github.com/firebase/php-jwt/issues",
-                "source": "https://github.com/firebase/php-jwt/tree/v6.10.2"
+                "source": "https://github.com/firebase/php-jwt/tree/v7.0.2"
             },
-            "time": "2024-11-24T11:22:49+00:00"
+            "time": "2025-12-16T22:17:28+00:00"
         },
         {
             "name": "psr/simple-cache",
diff --git a/lib/Config.php b/lib/Config.php
index 53c99f1e2cf..5d02cc4bea2 100644
--- a/lib/Config.php
+++ b/lib/Config.php
@@ -529,7 +529,7 @@ private function ensureSignalingTokenKeys(string $alg): void {
 
 		if (str_starts_with($alg, 'ES')) {
 			$privKey = openssl_pkey_new([
-				'curve_name' => 'prime256v1',
+				'curve_name' => $alg === 'ES384' ? 'secp384r1' : 'prime256v1',
 				'private_key_bits' => 2048,
 				'private_key_type' => OPENSSL_KEYTYPE_EC,
 			]);
diff --git a/lib/Migration/RegenerateSignalingKeys.php b/lib/Migration/RegenerateSignalingKeys.php
new file mode 100644
index 00000000000..808e867b0d8
--- /dev/null
+++ b/lib/Migration/RegenerateSignalingKeys.php
@@ -0,0 +1,48 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Talk\Migration;
+
+use OCA\Talk\Config;
+use OCP\AppFramework\Services\IAppConfig;
+use OCP\Migration\IOutput;
+use OCP\Migration\IRepairStep;
+
+/**
+ * In JWT 7.0.2 validation for the key length was added, and it revealed that
+ * Talk used a too short private key. So when generating a signaling ticket fails,
+ * we generate a new private and public key with more complex curve which fixes it.
+ */
+class RegenerateSignalingKeys implements IRepairStep {
+	public function __construct(
+		protected IAppConfig $appConfig,
+		protected Config $talkConfig,
+	) {
+	}
+
+	#[\Override]
+	public function getName(): string {
+		return 'Regenerate signaling keys';
+	}
+
+	#[\Override]
+	public function run(IOutput $output): void {
+		$alg = $this->talkConfig->getSignalingTokenAlgorithm();
+
+		if ($alg === 'ES384') {
+			try {
+				$this->talkConfig->getSignalingTicket(2, null);
+			} catch (\Exception $e) {
+				$this->appConfig->setAppValue('signaling_token_privkey_' . strtolower($alg), '');
+				$this->appConfig->setAppValue('signaling_token_pubkey_' . strtolower($alg), '');
+
+				$this->talkConfig->getSignalingTokenPrivateKey($alg);
+			}
+		}
+	}
+}