diff --git a/internal/api/oidc/integration_test/token_jwt_profile_test.go b/internal/api/oidc/integration_test/token_jwt_profile_test.go
index b4ae0d777..c01cd6659 100644
--- a/internal/api/oidc/integration_test/token_jwt_profile_test.go
+++ b/internal/api/oidc/integration_test/token_jwt_profile_test.go
@@ -26,6 +26,10 @@ func TestServer_JWTProfile(t *testing.T) {
 	_, _, keyDataExpired, err := Instance.CreateOIDCJWTProfileClient(CTX, 10*time.Second)
 	require.NoError(t, err)
 
+	project := Instance.CreateProject(CTX, t, "", integration.ProjectName(), false, false)
+	_, appKeyData, err := Instance.CreateOIDCWebClientJWT(CTX, redirectURI, logoutRedirectURI, project.GetId())
+	require.NoError(t, err)
+
 	type claims struct {
 		name                       string
 		username                   string
@@ -36,11 +40,12 @@ func TestServer_JWTProfile(t *testing.T) {
 		orgDomain                  any
 	}
 	tests := []struct {
-		name       string
-		keyData    []byte
-		scope      []string
-		wantClaims claims
-		wantErr    bool
+		name        string
+		keyData     []byte
+		scope       []string
+		wantClaims  claims
+		wantErr     bool
+		expectedErr error
 	}{
 		{
 			name:    "success",
@@ -107,10 +112,18 @@ func TestServer_JWTProfile(t *testing.T) {
 			},
 		},
 		{
-			name:    "key expired",
-			keyData: keyDataExpired,
-			scope:   []string{oidc.ScopeOpenID},
-			wantErr: true,
+			name:        "key expired",
+			keyData:     keyDataExpired,
+			scope:       []string{oidc.ScopeOpenID},
+			wantErr:     true,
+			expectedErr: oidc.ErrInvalidGrant().WithDescription("invalid assertion"),
+		},
+		{
+			name:        "key type application",
+			keyData:     appKeyData,
+			scope:       []string{oidc.ScopeOpenID},
+			wantErr:     true,
+			expectedErr: oidc.ErrInvalidGrant().WithDescription("invalid assertion"),
 		},
 	}
 	for _, tt := range tests {
@@ -132,6 +145,7 @@ func TestServer_JWTProfile(t *testing.T) {
 				time.Minute, time.Second,
 			)
 			if tt.wantErr {
+				assert.ErrorIs(t, err, tt.expectedErr)
 				return
 			}
 
diff --git a/internal/api/oidc/token_jwt_profile.go b/internal/api/oidc/token_jwt_profile.go
index cbcd069c2..989e5a816 100644
--- a/internal/api/oidc/token_jwt_profile.go
+++ b/internal/api/oidc/token_jwt_profile.go
@@ -8,6 +8,7 @@ import (
 	"github.com/zitadel/oidc/v3/pkg/oidc"
 	"github.com/zitadel/oidc/v3/pkg/op"
 
+	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/crypto"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/query"
@@ -76,7 +77,7 @@ func (s *Server) verifyJWTProfile(ctx context.Context, req *oidc.JWTProfileGrant
 	)
 	_, err = op.VerifyJWTAssertion(ctx, req.Assertion, verifier)
 	if err != nil {
-		return nil, err
+		return nil, oidc.ErrInvalidGrant().WithParent(err).WithReturnParentToClient(authz.GetFeatures(ctx).DebugOIDCParentError).WithDescription("invalid assertion")
 	}
 	return storage.user, nil
 }