diff --git a/pkg/oidc/error.go b/pkg/oidc/error.go
index e9f7327e..78ec0963 100644
--- a/pkg/oidc/error.go
+++ b/pkg/oidc/error.go
@@ -222,6 +222,7 @@ func DefaultToServerError(err error, description string) *Error {
 		oidcErr = ErrInvalidRequest().WithParent(err).WithDescription("%s", description)
 	case errors.Is(err, ErrIssuerInvalid),
 		errors.Is(err, ErrSubjectMissing),
+		errors.Is(err, ErrSubjectInvalid),
 		errors.Is(err, ErrAudience),
 		errors.Is(err, ErrAzpMissing),
 		errors.Is(err, ErrAzpInvalid),
diff --git a/pkg/oidc/error_test.go b/pkg/oidc/error_test.go
index b8f05077..1d546052 100644
--- a/pkg/oidc/error_test.go
+++ b/pkg/oidc/error_test.go
@@ -99,6 +99,16 @@ func TestDefaultToServerError(t *testing.T) {
 	}
 }
 
+// TestDefaultToServerError_SubjectInvalid guards against a regression where
+// ErrSubjectInvalid (returned by the JWT profile grant when iss != sub) was not
+// listed in the invalid_grant case and fell through to server_error (HTTP 500).
+// A rejected client assertion must map to invalid_grant per RFC 7523, matching
+// the sibling ErrSubjectMissing.
+func TestDefaultToServerError_SubjectInvalid(t *testing.T) {
+	got := DefaultToServerError(ErrSubjectInvalid, ErrSubjectInvalid.Error())
+	assert.Equal(t, InvalidGrant, got.ErrorType)
+}
+
 func TestError_LogLevel(t *testing.T) {
 	tests := []struct {
 		name string