diff --git a/packages/iios-kernel-client/package.json b/packages/iios-kernel-client/package.json
index f901a99..a9ecafe 100644
--- a/packages/iios-kernel-client/package.json
+++ b/packages/iios-kernel-client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@insignia/iios-kernel-client",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "type": "module",
   "main": "dist/index.js",
   "module": "dist/index.js",
diff --git a/packages/iios-kernel-client/src/rest.ts b/packages/iios-kernel-client/src/rest.ts
index b0d98cd..5b04608 100644
--- a/packages/iios-kernel-client/src/rest.ts
+++ b/packages/iios-kernel-client/src/rest.ts
@@ -4,8 +4,13 @@ import type { Message, InboxItem, InboxState, Ticket, TicketState, CallbackReque
 export interface RestConfig {
   serviceUrl: string;
   token?: string;
-  /** Extra headers sent on every request — e.g. `x-context-attestation` (the July 12 trust proof). */
-  headers?: Record<string, string>;
+  /**
+   * Extra headers for every request — e.g. `x-context-attestation` (the July 12 trust proof).
+   * Pass a FUNCTION to mint fresh headers per request: a context attestation carries a single-use
+   * nonce, so a static header would be replay-rejected on the 2nd call. The function is invoked
+   * once per request.
+   */
+  headers?: Record<string, string> | (() => Record<string, string>);
 }
 
 /** REST/polling client for kernel reads and the native-send fallback. */
@@ -17,7 +22,8 @@ export class RestClient {
   }
 
   private headers(extra: Record<string, string> = {}): Record<string, string> {
-    const h: Record<string, string> = { 'content-type': 'application/json', ...this.config.headers, ...extra };
+    const custom = typeof this.config.headers === 'function' ? this.config.headers() : this.config.headers;
+    const h: Record<string, string> = { 'content-type': 'application/json', ...custom, ...extra };
     if (this.config.token) h.authorization = `Bearer ${this.config.token}`;
     return h;
   }