diff --git a/paskia/util/oidjwt.py b/paskia/util/oidjwt.py
index 81c99a3..0bb3272 100644
--- a/paskia/util/oidjwt.py
+++ b/paskia/util/oidjwt.py
@@ -186,12 +186,18 @@ def decode_access_token(
     """
     _ensure_key()
     try:
+        # Don't pass audience if None to avoid PyJWT audience validation
+        decode_kwargs = {
+            "algorithms": ["EdDSA"],
+            "issuer": issuer,
+        }
+        if audience is not None:
+            decode_kwargs["audience"] = audience
+            
         return jwt.decode(
             token,
             _public_key,
-            algorithms=["EdDSA"],
-            issuer=issuer,
-            audience=audience,  # PyJWT handles None by skipping verification
+            **decode_kwargs
         )
     except jwt.PyJWTError as e:
         print(f"DEBUG JWT decode error: {e}")