diff --git a/Server/api/block_handler.go b/Server/api/block_handler.go
index 09803059..9ac661d0 100644
--- a/Server/api/block_handler.go
+++ b/Server/api/block_handler.go
@@ -1,7 +1,6 @@
 package api
 
 import (
-	"encoding/json"
 	"log/slog"
 	"net/http"
 	"strconv"
@@ -13,8 +12,8 @@ import (
 // handleBlockUser blocks a user (prevents DM creation and messaging).
 func handleBlockUser(database *db.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		user := getUserFromContext(r)
-		if user == nil {
+		user, ok := r.Context().Value(UserKey).(*db.User)
+		if !ok || user == nil {
 			writeJSON(w, http.StatusUnauthorized, errorResponse{
 				Error:   "UNAUTHORIZED",
 				Message: "not authenticated",
@@ -75,8 +74,8 @@ func handleBlockUser(database *db.DB) http.HandlerFunc {
 // handleUnblockUser removes a block on a user.
 func handleUnblockUser(database *db.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		user := getUserFromContext(r)
-		if user == nil {
+		user, ok := r.Context().Value(UserKey).(*db.User)
+		if !ok || user == nil {
 			writeJSON(w, http.StatusUnauthorized, errorResponse{
 				Error:   "UNAUTHORIZED",
 				Message: "not authenticated",
@@ -111,8 +110,8 @@ func handleUnblockUser(database *db.DB) http.HandlerFunc {
 // handleListBlocks returns all users blocked by the authenticated user.
 func handleListBlocks(database *db.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		user := getUserFromContext(r)
-		if user == nil {
+		user, ok := r.Context().Value(UserKey).(*db.User)
+		if !ok || user == nil {
 			writeJSON(w, http.StatusUnauthorized, errorResponse{
 				Error:   "UNAUTHORIZED",
 				Message: "not authenticated",
diff --git a/Server/api/constants.go b/Server/api/constants.go
index 1c8bea50..9ffc9cea 100644
--- a/Server/api/constants.go
+++ b/Server/api/constants.go
@@ -16,7 +16,7 @@ const (
 	registerRateLimitPerMinute = 3
 
 	// loginRateLimitPerMinute is the maximum login attempts per IP per minute.
-	loginRateLimitPerMinute = 60
+	loginRateLimitPerMinute = 5
 
 	// verifyTOTPRateLimitPerMinute is the maximum TOTP verification attempts per IP per minute.
 	verifyTOTPRateLimitPerMinute = 10
diff --git a/Server/api/constants_test.go b/Server/api/constants_test.go
new file mode 100644
index 00000000..c5863493
--- /dev/null
+++ b/Server/api/constants_test.go
@@ -0,0 +1,10 @@
+package api
+
+import "testing"
+
+// I-7: loginRateLimitPerMinute must be 5 (not 60).
+func TestLoginRateLimit_Value(t *testing.T) {
+	if loginRateLimitPerMinute != 5 {
+		t.Errorf("loginRateLimitPerMinute = %d, want 5", loginRateLimitPerMinute)
+	}
+}
diff --git a/Server/api/dm_handler_test.go b/Server/api/dm_handler_test.go
index d44433cb..508f2a28 100644
--- a/Server/api/dm_handler_test.go
+++ b/Server/api/dm_handler_test.go
@@ -109,6 +109,14 @@ CREATE TABLE IF NOT EXISTS read_states (
     mention_count   INTEGER NOT NULL DEFAULT 0,
     PRIMARY KEY (user_id, channel_id)
 );
+
+CREATE TABLE IF NOT EXISTS user_blocks (
+    blocker_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    blocked_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    created_at TEXT    NOT NULL DEFAULT (datetime('now')),
+    PRIMARY KEY (blocker_id, blocked_id),
+    CHECK (blocker_id != blocked_id)
+);
 `)
 
 // ─── helpers ────────────────────────────────────────────────────────────────
diff --git a/Server/api/router.go b/Server/api/router.go
index 9211f86d..9ab16f1e 100644
--- a/Server/api/router.go
+++ b/Server/api/router.go
@@ -180,7 +180,7 @@ func NewRouter(cfg *config.Config, database *db.DB, ver string, logBuf *admin.Ri
 	// H-8: Connectivity diagnostics restricted to admin users only.
 	// Exposes Go runtime version and LiveKit node IP which aid targeted attacks.
 	r.With(AuthMiddleware(database),
-		RequirePermission(database, permissions.Administrator),
+		RequirePermission(permissions.Administrator),
 		RateLimitMiddleware(limiter, 5, time.Minute, cfg.Server.TrustedProxies)).
 		Get("/api/v1/diagnostics/connectivity",
 			handleDiagnosticsConnectivity(cfg, ver, hub))
diff --git a/Server/ws/client.go b/Server/ws/client.go
index a60c8400..b19cd9ce 100644
--- a/Server/ws/client.go
+++ b/Server/ws/client.go
@@ -129,6 +129,16 @@ func SetClientVoiceStateForTest(c *Client, channelID int64, joinToken string) {
 	c.voiceJoinToken = joinToken
 }
 
+// SetClientE2EEPubKeyForTest sets the E2EE public key on a client. For test use only.
+func SetClientE2EEPubKeyForTest(c *Client, key string) {
+	c.setE2EEPubKey(key)
+}
+
+// GetClientE2EEPubKeyForTest returns the E2EE public key from a client. For test use only.
+func GetClientE2EEPubKeyForTest(c *Client) string {
+	return c.getE2EEPubKey()
+}
+
 // NewTestClientWithTokenHash creates a test client that carries a session token
 // hash. Use this when tests need to exercise the periodic session-expiry check.
 func NewTestClientWithTokenHash(hub *Hub, user *db.User, tokenHash string, channelID int64, send chan []byte) *Client {
diff --git a/Server/ws/errors.go b/Server/ws/errors.go
index 4d73ce5d..5abcbb7c 100644
--- a/Server/ws/errors.go
+++ b/Server/ws/errors.go
@@ -16,4 +16,6 @@ const (
 	ErrCodeUnknownType   = "UNKNOWN_TYPE"
 	ErrCodeSlowMode      = "SLOW_MODE"
 	ErrCodeConflict      = "CONFLICT"
+	ErrCodeBadPayload    = "BAD_PAYLOAD"
+	ErrCodeNotKeyHolder  = "NOT_KEY_HOLDER"
 )
diff --git a/Server/ws/hub.go b/Server/ws/hub.go
index a7d07e69..3fb28aea 100644
--- a/Server/ws/hub.go
+++ b/Server/ws/hub.go
@@ -51,6 +51,11 @@ type Hub struct {
 	settingsMotd       string
 	settingsLastUpdate time.Time
 
+	// voiceKeyHolders maps channelID → userID of the current key holder.
+	// The key holder is the connected participant with the lowest userID in the channel.
+	// Protected by keyHolderMu.
+	keyHolderMu     sync.RWMutex
+	voiceKeyHolders map[int64]int64
 }
 
 // NewHub creates a Hub ready to be started with Run.
@@ -64,18 +69,19 @@ func NewHub(database *db.DB, limiter *auth.RateLimiter) *Hub {
 	registerPingHandler(reg)
 
 	h := &Hub{
-		clients:      make(map[int64]*Client),
-		db:           database,
-		limiter:      limiter,
-		broadcast:    make(chan broadcastMsg, 1024),
-		register:     make(chan *Client, 32),
-		unregister:   make(chan *Client, 32),
-		stop:         make(chan struct{}),
-		replayBuf:    NewEventRingBuffer(1000),
-		registry:     reg,
-		permChecker:  permissions.NewChecker(database),
-		settingsName: "OwnCord Server",
-		settingsMotd: "Welcome!",
+		clients:         make(map[int64]*Client),
+		db:              database,
+		limiter:         limiter,
+		broadcast:       make(chan broadcastMsg, 1024),
+		register:        make(chan *Client, 32),
+		unregister:      make(chan *Client, 32),
+		stop:            make(chan struct{}),
+		replayBuf:       NewEventRingBuffer(1000),
+		registry:        reg,
+		permChecker:     permissions.NewChecker(database),
+		settingsName:    "OwnCord Server",
+		settingsMotd:    "Welcome!",
+		voiceKeyHolders: make(map[int64]int64),
 	}
 	h.refreshSettingsLocked()
 	return h
@@ -282,7 +288,6 @@ func (h *Hub) CleanupVoiceForChannel(channelID int64) {
 	for _, vs := range states {
 		h.BroadcastToAll(buildVoiceLeave(channelID, vs.UserID))
 	}
-
 }
 
 // IsUserConnected returns true if a client with the given userID is already
diff --git a/Server/ws/hub_test.go b/Server/ws/hub_test.go
index 73112eac..1084e1f6 100644
--- a/Server/ws/hub_test.go
+++ b/Server/ws/hub_test.go
@@ -991,4 +991,12 @@ CREATE TABLE IF NOT EXISTS dm_open_state (
     opened_at  TEXT NOT NULL DEFAULT (datetime('now')),
     PRIMARY KEY (user_id, channel_id)
 );
+
+CREATE TABLE IF NOT EXISTS user_blocks (
+    blocker_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    blocked_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    created_at TEXT    NOT NULL DEFAULT (datetime('now')),
+    PRIMARY KEY (blocker_id, blocked_id),
+    CHECK (blocker_id != blocked_id)
+);
 `)
diff --git a/Server/ws/messages.go b/Server/ws/messages.go
index c883f927..12ef5bb8 100644
--- a/Server/ws/messages.go
+++ b/Server/ws/messages.go
@@ -122,10 +122,11 @@ type voiceConfigPayload struct {
 }
 
 type voiceTokenPayload struct {
-	ChannelID int64  `json:"channel_id"`
-	Token     string `json:"token"`
-	URL       string `json:"url"`
-	DirectURL string `json:"direct_url"`
+	ChannelID   int64  `json:"channel_id"`
+	Token       string `json:"token"`
+	URL         string `json:"url"`
+	DirectURL   string `json:"direct_url"`
+	IsKeyHolder bool   `json:"is_key_holder"`
 }
 
 // ── Voice E2EE (client-side ECDH key exchange) ─────────────────────────────
@@ -411,14 +412,15 @@ func buildVoiceConfig(channelID int64, quality string, bitrate int, maxUsers int
 // buildVoiceToken constructs a voice_token message with a LiveKit token and URL.
 // url is the proxy path ("/livekit") for remote clients; direct_url is the raw
 // LiveKit URL (e.g. "ws://localhost:7880") for localhost clients.
-func buildVoiceToken(channelID int64, token string, proxyPath string, directURL string) []byte { //nolint:unparam // kept configurable for proxy path flexibility
+func buildVoiceToken(channelID int64, token string, proxyPath string, directURL string, isKeyHolder bool) []byte { //nolint:unparam // kept configurable for proxy path flexibility
 	return buildJSON(wsMsg{
 		Type: MsgTypeVoiceToken,
 		Payload: voiceTokenPayload{
-			ChannelID: channelID,
-			Token:     token,
-			URL:       proxyPath,
-			DirectURL: directURL,
+			ChannelID:   channelID,
+			Token:       token,
+			URL:         proxyPath,
+			DirectURL:   directURL,
+			IsKeyHolder: isKeyHolder,
 		},
 	})
 }
diff --git a/Server/ws/messages_test.go b/Server/ws/messages_test.go
index 784c6419..b3e11950 100644
--- a/Server/ws/messages_test.go
+++ b/Server/ws/messages_test.go
@@ -541,7 +541,7 @@ func TestBuildTypingMsg_ValidJSON(t *testing.T) {
 // ─── buildVoiceToken ──────────────────────────────────────────────────────────
 
 func TestBuildVoiceToken_Type(t *testing.T) {
-	msg := buildVoiceToken(99, "jwt-token", "/livekit", "ws://localhost:7880")
+	msg := buildVoiceToken(99, "jwt-token", "/livekit", "ws://localhost:7880", false)
 	var env struct {
 		Type string `json:"type"`
 	}
@@ -554,7 +554,7 @@ func TestBuildVoiceToken_Type(t *testing.T) {
 }
 
 func TestBuildVoiceToken_Payload(t *testing.T) {
-	msg := buildVoiceToken(99, "jwt-token", "/livekit", "ws://localhost:7880")
+	msg := buildVoiceToken(99, "jwt-token", "/livekit", "ws://localhost:7880", false)
 	var env struct {
 		Payload struct {
 			ChannelID int64  `json:"channel_id"`
@@ -583,7 +583,7 @@ func TestBuildVoiceToken_Payload(t *testing.T) {
 func TestBuildVoiceToken_NoE2EEKey(t *testing.T) {
 	// E2EE keys are now exchanged client-side via ECDH; voice_token must not
 	// contain an e2ee_key field.
-	msg := buildVoiceToken(1, "t", "/livekit", "ws://a")
+	msg := buildVoiceToken(1, "t", "/livekit", "ws://a", false)
 	var body map[string]any
 	if err := json.Unmarshal(msg, &body); err != nil {
 		t.Fatalf("unmarshal: %v", err)
@@ -595,7 +595,7 @@ func TestBuildVoiceToken_NoE2EEKey(t *testing.T) {
 }
 
 func TestBuildVoiceToken_ValidJSON(t *testing.T) {
-	if !json.Valid(buildVoiceToken(1, "t", "/livekit", "ws://a")) {
+	if !json.Valid(buildVoiceToken(1, "t", "/livekit", "ws://a", false)) {
 		t.Error("buildVoiceToken output is not valid JSON")
 	}
 }
diff --git a/Server/ws/registry_test.go b/Server/ws/registry_test.go
index 5885b9f4..b47c5ff9 100644
--- a/Server/ws/registry_test.go
+++ b/Server/ws/registry_test.go
@@ -60,6 +60,8 @@ func TestHandlerRegistry_AllExpectedTypesRegistered(t *testing.T) {
 		"voice_deafen",
 		"voice_camera",
 		"voice_screenshare",
+		"voice_e2ee_announce",
+		"voice_e2ee_offer",
 		"ping",
 	}
 
diff --git a/Server/ws/voice_e2ee.go b/Server/ws/voice_e2ee.go
index e48411cd..9a8a2226 100644
--- a/Server/ws/voice_e2ee.go
+++ b/Server/ws/voice_e2ee.go
@@ -7,6 +7,66 @@ import (
 	"log/slog"
 )
 
+// decodeBase64Loose accepts both standard (padded) and raw (unpadded) base64.
+// ECDH public keys exported from WebCrypto use raw base64 (no '=' padding);
+// we accept both to avoid breaking existing clients.
+func decodeBase64Loose(s string) ([]byte, error) {
+	if b, err := base64.StdEncoding.DecodeString(s); err == nil {
+		return b, nil
+	}
+	return base64.RawStdEncoding.DecodeString(s)
+}
+
+// updateKeyHolder scans connected clients to find the one with the lowest
+// userID currently in channelID, and records them as the key holder.
+// If no clients remain in the channel the entry is deleted.
+// Must NOT be called while h.mu is held (it acquires h.mu.RLock internally).
+func (h *Hub) updateKeyHolder(channelID int64) {
+	h.mu.RLock()
+	var minUserID int64
+	found := false
+	for uid, c := range h.clients {
+		if c.getVoiceChID() == channelID {
+			if !found || uid < minUserID {
+				minUserID = uid
+				found = true
+			}
+		}
+	}
+	h.mu.RUnlock()
+
+	h.keyHolderMu.Lock()
+	if found {
+		h.voiceKeyHolders[channelID] = minUserID
+	} else {
+		delete(h.voiceKeyHolders, channelID)
+	}
+	h.keyHolderMu.Unlock()
+}
+
+// isVoiceKeyHolder reports whether userID is the current key holder for channelID.
+func (h *Hub) isVoiceKeyHolder(channelID, userID int64) bool {
+	h.keyHolderMu.RLock()
+	kh, ok := h.voiceKeyHolders[channelID]
+	h.keyHolderMu.RUnlock()
+	return ok && kh == userID
+}
+
+// computeIsKeyHolder determines whether userID will become the key holder when
+// joining channelID. Returns true if no connected client in that channel has a
+// lower userID. This is used before calling setVoiceState so the result can be
+// included in the voice_token message sent to the joiner.
+func (h *Hub) computeIsKeyHolder(channelID, userID int64) bool {
+	h.mu.RLock()
+	defer h.mu.RUnlock()
+	for uid, c := range h.clients {
+		if c.getVoiceChID() == channelID && uid < userID {
+			return false
+		}
+	}
+	return true
+}
+
 // handleVoiceE2EEAnnounce processes a client's ECDH public key announcement.
 // The server stores the key on the Client struct and relays it to all other
 // participants in the same voice channel. The server never sees or generates
@@ -33,7 +93,7 @@ func (h *Hub) handleVoiceE2EEAnnounce(_ context.Context, c *Client, payload json
 		c.sendMsg(buildErrorMsg(ErrCodeBadPayload, "public_key too large"))
 		return
 	}
-	if _, err := base64.StdEncoding.DecodeString(p.PublicKey); err != nil {
+	if _, err := decodeBase64Loose(p.PublicKey); err != nil {
 		c.sendMsg(buildErrorMsg(ErrCodeBadPayload, "public_key is not valid base64"))
 		return
 	}
@@ -73,15 +133,22 @@ func (h *Hub) handleVoiceE2EEOffer(_ context.Context, c *Client, payload json.Ra
 		c.sendMsg(buildErrorMsg(ErrCodeBadPayload, "encrypted_key or iv too large"))
 		return
 	}
-	if _, err := base64.StdEncoding.DecodeString(p.EncryptedKey); err != nil {
+	if _, err := decodeBase64Loose(p.EncryptedKey); err != nil {
 		c.sendMsg(buildErrorMsg(ErrCodeBadPayload, "encrypted_key is not valid base64"))
 		return
 	}
-	if _, err := base64.StdEncoding.DecodeString(p.IV); err != nil {
+	if _, err := decodeBase64Loose(p.IV); err != nil {
 		c.sendMsg(buildErrorMsg(ErrCodeBadPayload, "iv is not valid base64"))
 		return
 	}
 
+	// I-1: Only the designated key holder may distribute the room key. This
+	// prevents any other participant from performing a key substitution attack.
+	if !h.isVoiceKeyHolder(voiceChID, c.userID) {
+		c.sendMsg(buildErrorMsg(ErrCodeNotKeyHolder, "only the key holder may send key offers"))
+		return
+	}
+
 	// Verify the target is in the same voice channel — lookup and channel
 	// check must be atomic (under the same lock hold) to prevent TOCTOU races
 	// where the target leaves between lookup and the channel comparison.
@@ -124,12 +191,21 @@ func (h *Hub) sendToVoiceChannelExcept(channelID int64, excludeUserID int64, msg
 }
 
 // getClientE2EEPubKey returns the stored ECDH public key for a connected user.
+// I-6 fix: Copy the public key value while h.mu.RLock is still held so the
+// client cannot be garbage collected between the lookup and the key read.
 func (h *Hub) getClientE2EEPubKey(userID int64) string {
 	h.mu.RLock()
 	c, ok := h.clients[userID]
-	h.mu.RUnlock()
 	if !ok {
+		h.mu.RUnlock()
 		return ""
 	}
-	return c.getE2EEPubKey()
+	key := c.getE2EEPubKey()
+	h.mu.RUnlock()
+	return key
+}
+
+// GetClientE2EEPubKeyForTest is an exported wrapper for tests.
+func (h *Hub) GetClientE2EEPubKeyForTest(userID int64) string {
+	return h.getClientE2EEPubKey(userID)
 }
diff --git a/Server/ws/voice_e2ee_test.go b/Server/ws/voice_e2ee_test.go
new file mode 100644
index 00000000..1993a937
--- /dev/null
+++ b/Server/ws/voice_e2ee_test.go
@@ -0,0 +1,477 @@
+package ws_test
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/owncord/server/ws"
+)
+
+// ─── helpers ─────────────────────────────────────────────────────────────────
+
+// e2eeAnnounceMsg builds a voice_e2ee_announce WebSocket message.
+func e2eeAnnounceMsg(publicKey string) []byte {
+	raw, _ := json.Marshal(map[string]any{
+		"type":    "voice_e2ee_announce",
+		"payload": map[string]any{"public_key": publicKey},
+	})
+	return raw
+}
+
+// e2eeOfferMsg builds a voice_e2ee_offer WebSocket message.
+func e2eeOfferMsg(targetUserID int64, encryptedKey, iv string) []byte {
+	raw, _ := json.Marshal(map[string]any{
+		"type": "voice_e2ee_offer",
+		"payload": map[string]any{
+			"target_user_id": targetUserID,
+			"encrypted_key":  encryptedKey,
+			"iv":             iv,
+		},
+	})
+	return raw
+}
+
+// extractPayloadField extracts a string field from payload of a JSON message.
+func extractPayloadField(t *testing.T, msg []byte, field string) any {
+	t.Helper()
+	var env map[string]any
+	if err := json.Unmarshal(msg, &env); err != nil {
+		t.Fatalf("extractPayloadField unmarshal: %v", err)
+	}
+	payload, ok := env["payload"].(map[string]any)
+	if !ok {
+		return nil
+	}
+	return payload[field]
+}
+
+// extractMessage extracts the "message" field from an error payload.
+func extractMessage(t *testing.T, msg []byte) string {
+	t.Helper()
+	v := extractPayloadField(t, msg, "message")
+	s, _ := v.(string)
+	return s
+}
+
+// validB64Key returns a valid base64-encoded 65-byte P-256 public key.
+func validB64Key() string {
+	key := make([]byte, 65)
+	key[0] = 0x04 // uncompressed P-256 marker
+	return base64.StdEncoding.EncodeToString(key)
+}
+
+// validURLSafeB64Key returns a URL-safe (no padding) base64-encoded key.
+func validURLSafeB64Key() string {
+	key := make([]byte, 65)
+	key[0] = 0x04
+	return base64.RawStdEncoding.EncodeToString(key)
+}
+
+// validB64 returns a small valid base64 string.
+func validB64(data string) string {
+	return base64.StdEncoding.EncodeToString([]byte(data))
+}
+
+// validRawB64 returns a raw (no padding) base64 string.
+func validRawB64(data string) string {
+	return base64.RawStdEncoding.EncodeToString([]byte(data))
+}
+
+// ─── C-1: TOCTOU race — target channel check must be inside lock ─────────────
+
+func TestE2EE_Offer_TargetChannelCheckAtomicWithLookup(t *testing.T) {
+	// This test verifies the fix for C-1: the target's voice channel ID
+	// is read while h.mu.RLock is held, so there's no window for the target
+	// to leave between lookup and channel check.
+	hub, database := newVoiceHub(t)
+	chanID := seedVoiceChan(t, database, "vc-toctou")
+
+	// sender joins voice
+	sender := seedVoiceOwner(t, database, "toctou-sender")
+	sendCh := make(chan []byte, 32)
+	senderClient := ws.NewTestClientWithUser(hub, sender, 0, sendCh)
+	hub.Register(senderClient)
+	time.Sleep(20 * time.Millisecond)
+	hub.HandleMessageForTest(senderClient, voiceJoinMsg(chanID))
+	time.Sleep(30 * time.Millisecond)
+	drainChan(sendCh)
+
+	// target joins voice
+	target := seedVoiceOwner(t, database, "toctou-target")
+	targetCh := make(chan []byte, 32)
+	targetClient := ws.NewTestClientWithUser(hub, target, 0, targetCh)
+	hub.Register(targetClient)
+	time.Sleep(20 * time.Millisecond)
+	hub.HandleMessageForTest(targetClient, voiceJoinMsg(chanID))
+	time.Sleep(30 * time.Millisecond)
+	drainChan(targetCh)
+
+	// Send an E2EE offer from sender to target — should succeed since both
+	// are in the same channel.
+	encKey := validB64("encrypted-room-key-data")
+	iv := validB64("twelve-bytes")
+	hub.HandleMessageForTest(senderClient, e2eeOfferMsg(target.ID, encKey, iv))
+	time.Sleep(30 * time.Millisecond)
+
+	// Target should receive the offer relay.
+	msgs := drainChan(targetCh)
+	found := false
+	for _, m := range msgs {
+		if extractType(t, m) == "voice_e2ee_offer" {
+			found = true
+		}
+	}
+	if !found {
+		t.Error("target did not receive voice_e2ee_offer relay")
+	}
+}
+
+// ─── I-1: Key holder validation — only key holder can send offers ────────────
+
+func TestE2EE_Offer_RejectsNonKeyHolder(t *testing.T) {
+	// I-1: Only the key holder (lowest user ID in the channel) may send offers.
+	hub, database := newVoiceHub(t)
+	chanID := seedVoiceChan(t, database, "vc-keyholder")
+
+	// user1 (lower ID) joins first — should be key holder
+	user1 := seedVoiceOwner(t, database, "kh-user1")
+	send1 := make(chan []byte, 32)
+	c1 := ws.NewTestClientWithUser(hub, user1, 0, send1)
+	hub.Register(c1)
+	time.Sleep(20 * time.Millisecond)
+	hub.HandleMessageForTest(c1, voiceJoinMsg(chanID))
+	time.Sleep(30 * time.Millisecond)
+	drainChan(send1)
+
+	// user2 (higher ID) joins — should NOT be key holder
+	user2 := seedVoiceOwner(t, database, "kh-user2")
+	send2 := make(chan []byte, 32)
+	c2 := ws.NewTestClientWithUser(hub, user2, 0, send2)
+	hub.Register(c2)
+	time.Sleep(20 * time.Millisecond)
+	hub.HandleMessageForTest(c2, voiceJoinMsg(chanID))
+	time.Sleep(30 * time.Millisecond)
+	drainChan(send2)
+
+	// user2 tries to send an E2EE offer — should be rejected
+	encKey := validB64("encrypted-room-key-data")
+	iv := validB64("twelve-bytes")
+	hub.HandleMessageForTest(c2, e2eeOfferMsg(user1.ID, encKey, iv))
+	time.Sleep(30 * time.Millisecond)
+
+	msgs := drainChan(send2)
+	found := false
+	for _, m := range msgs {
+		if extractType(t, m) == "error" && extractCode(t, m) == "NOT_KEY_HOLDER" {
+			found = true
+		}
+	}
+	if !found {
+		t.Error("non-key-holder offer should be rejected with NOT_KEY_HOLDER error")
+	}
+}
+
+func TestE2EE_Offer_KeyHolderCanSend(t *testing.T) {
+	// I-1: The key holder (lowest user ID) can send offers.
+	hub, database := newVoiceHub(t)
+	chanID := seedVoiceChan(t, database, "vc-keyholder-ok")
+
+	// user1 (lower ID) joins first — key holder
+	user1 := seedVoiceOwner(t, database, "kh-ok-user1")
+	send1 := make(chan []byte, 32)
+	c1 := ws.NewTestClientWithUser(hub, user1, 0, send1)
+	hub.Register(c1)
+	time.Sleep(20 * time.Millisecond)
+	hub.HandleMessageForTest(c1, voiceJoinMsg(chanID))
+	time.Sleep(30 * time.Millisecond)
+	drainChan(send1)
+
+	// user2 (higher ID) joins
+	user2 := seedVoiceOwner(t, database, "kh-ok-user2")
+	send2 := make(chan []byte, 32)
+	c2 := ws.NewTestClientWithUser(hub, user2, 0, send2)
+	hub.Register(c2)
+	time.Sleep(20 * time.Millisecond)
+	hub.HandleMessageForTest(c2, voiceJoinMsg(chanID))
+	time.Sleep(30 * time.Millisecond)
+	drainChan(send2)
+
+	// user1 (key holder) sends offer to user2 — should succeed
+	encKey := validB64("encrypted-room-key-data")
+	iv := validB64("twelve-bytes")
+	hub.HandleMessageForTest(c1, e2eeOfferMsg(user2.ID, encKey, iv))
+	time.Sleep(30 * time.Millisecond)
+
+	msgs := drainChan(send2)
+	found := false
+	for _, m := range msgs {
+		if extractType(t, m) == "voice_e2ee_offer" {
+			found = true
+		}
+	}
+	if !found {
+		t.Error("key holder's offer should be relayed to target")
+	}
+}
+
+func TestE2EE_KeyHolderTransfersOnLeave(t *testing.T) {
+	// I-1: When key holder leaves, the next lowest user ID becomes key holder.
+	hub, database := newVoiceHub(t)
+	chanID := seedVoiceChan(t, database, "vc-kh-transfer")
+
+	// user1 (lower ID) joins — key holder
+	user1 := seedVoiceOwner(t, database, "kht-user1")
+	send1 := make(chan []byte, 32)
+	c1 := ws.NewTestClientWithUser(hub, user1, 0, send1)
+	hub.Register(c1)
+	time.Sleep(20 * time.Millisecond)
+	hub.HandleMessageForTest(c1, voiceJoinMsg(chanID))
+	time.Sleep(30 * time.Millisecond)
+	drainChan(send1)
+
+	// user2 (higher ID) joins
+	user2 := seedVoiceOwner(t, database, "kht-user2")
+	send2 := make(chan []byte, 32)
+	c2 := ws.NewTestClientWithUser(hub, user2, 0, send2)
+	hub.Register(c2)
+	time.Sleep(20 * time.Millisecond)
+	hub.HandleMessageForTest(c2, voiceJoinMsg(chanID))
+	time.Sleep(30 * time.Millisecond)
+
+	// user3 (highest ID) joins
+	user3 := seedVoiceOwner(t, database, "kht-user3")
+	send3 := make(chan []byte, 32)
+	c3 := ws.NewTestClientWithUser(hub, user3, 0, send3)
+	hub.Register(c3)
+	time.Sleep(20 * time.Millisecond)
+	hub.HandleMessageForTest(c3, voiceJoinMsg(chanID))
+	time.Sleep(30 * time.Millisecond)
+	drainChan(send1)
+	drainChan(send2)
+	drainChan(send3)
+
+	// user1 (key holder) leaves
+	hub.HandleMessageForTest(c1, voiceLeaveMsg())
+	time.Sleep(50 * time.Millisecond)
+	drainChan(send2)
+	drainChan(send3)
+
+	// Now user2 should be key holder — user2 sends offer to user3
+	encKey := validB64("new-key")
+	iv := validB64("twelve-bytes")
+	hub.HandleMessageForTest(c2, e2eeOfferMsg(user3.ID, encKey, iv))
+	time.Sleep(30 * time.Millisecond)
+
+	msgs := drainChan(send3)
+	found := false
+	for _, m := range msgs {
+		if extractType(t, m) == "voice_e2ee_offer" {
+			found = true
+		}
+	}
+	if !found {
+		t.Error("after key holder leaves, next lowest user should become key holder and be able to send offers")
+	}
+}
+
+// ─── I-2: base64 validation — accept both standard and raw base64 ────────────
+
+func TestE2EE_Announce_AcceptsRawBase64(t *testing.T) {
+	// I-2: URL-safe / raw base64 (no padding) should be accepted.
+	hub, database := newVoiceHub(t)
+	chanID := seedVoiceChan(t, database, "vc-b64")
+
+	user := seedVoiceOwner(t, database, "b64-user")
+	sendCh := make(chan []byte, 32)
+	c := ws.NewTestClientWithUser(hub, user, 0, sendCh)
+	hub.Register(c)
+	time.Sleep(20 * time.Millisecond)
+	hub.HandleMessageForTest(c, voiceJoinMsg(chanID))
+	time.Sleep(30 * time.Millisecond)
+	drainChan(sendCh)
+
+	// Send announce with raw (no padding) base64 key
+	rawKey := validURLSafeB64Key()
+	hub.HandleMessageForTest(c, e2eeAnnounceMsg(rawKey))
+	time.Sleep(30 * time.Millisecond)
+
+	// Should NOT receive an error
+	msgs := drainChan(sendCh)
+	for _, m := range msgs {
+		if extractType(t, m) == "error" {
+			t.Errorf("raw base64 should be accepted, got error: %s", extractMessage(t, m))
+		}
+	}
+}
+
+func TestE2EE_Offer_AcceptsRawBase64(t *testing.T) {
+	// I-2: Raw base64 in encrypted_key and iv should be accepted.
+	hub, database := newVoiceHub(t)
+	chanID := seedVoiceChan(t, database, "vc-b64-offer")
+
+	// user1 is key holder (lowest ID)
+	user1 := seedVoiceOwner(t, database, "b64o-user1")
+	send1 := make(chan []byte, 32)
+	c1 := ws.NewTestClientWithUser(hub, user1, 0, send1)
+	hub.Register(c1)
+	time.Sleep(20 * time.Millisecond)
+	hub.HandleMessageForTest(c1, voiceJoinMsg(chanID))
+	time.Sleep(30 * time.Millisecond)
+	drainChan(send1)
+
+	user2 := seedVoiceOwner(t, database, "b64o-user2")
+	send2 := make(chan []byte, 32)
+	c2 := ws.NewTestClientWithUser(hub, user2, 0, send2)
+	hub.Register(c2)
+	time.Sleep(20 * time.Millisecond)
+	hub.HandleMessageForTest(c2, voiceJoinMsg(chanID))
+	time.Sleep(30 * time.Millisecond)
+	drainChan(send1)
+	drainChan(send2)
+
+	// Send offer with raw (no padding) base64
+	encKey := validRawB64("encrypted-room-key-data")
+	iv := validRawB64("twelve-bytes")
+	hub.HandleMessageForTest(c1, e2eeOfferMsg(user2.ID, encKey, iv))
+	time.Sleep(30 * time.Millisecond)
+
+	// Should NOT get an error on sender
+	msgs1 := drainChan(send1)
+	for _, m := range msgs1 {
+		if extractType(t, m) == "error" {
+			t.Errorf("raw base64 in offer should be accepted, got error: %s", extractMessage(t, m))
+		}
+	}
+
+	// Target should receive the relay
+	msgs2 := drainChan(send2)
+	found := false
+	for _, m := range msgs2 {
+		if extractType(t, m) == "voice_e2ee_offer" {
+			found = true
+		}
+	}
+	if !found {
+		t.Error("target should receive offer with raw base64")
+	}
+}
+
+// ─── I-6: getClientE2EEPubKey — copy key while lock held ────────────────────
+
+func TestE2EE_GetPubKey_ReturnsKeyAfterAnnounce(t *testing.T) {
+	// I-6: After announce, getClientE2EEPubKey should return the stored key
+	// by copying the value while h.mu.RLock is held.
+	hub, database := newVoiceHub(t)
+	chanID := seedVoiceChan(t, database, "vc-pubkey")
+
+	user := seedVoiceOwner(t, database, "pubkey-user")
+	sendCh := make(chan []byte, 32)
+	c := ws.NewTestClientWithUser(hub, user, 0, sendCh)
+	hub.Register(c)
+	time.Sleep(20 * time.Millisecond)
+	hub.HandleMessageForTest(c, voiceJoinMsg(chanID))
+	time.Sleep(30 * time.Millisecond)
+	drainChan(sendCh)
+
+	// Announce a public key
+	key := validB64Key()
+	hub.HandleMessageForTest(c, e2eeAnnounceMsg(key))
+	time.Sleep(30 * time.Millisecond)
+
+	// Retrieve via hub method — the key should be copied under lock
+	got := hub.GetClientE2EEPubKeyForTest(user.ID)
+	if got != key {
+		t.Errorf("GetClientE2EEPubKey = %q, want %q", got, key)
+	}
+}
+
+// ─── I-7: login rate limit ──────────────────────────────────────────────────
+
+func TestLoginRateLimit_Is5(t *testing.T) {
+	// I-7: loginRateLimitPerMinute should be 5, not 60.
+	// We can't directly access the constant from ws_test, but we test the
+	// behavior via the API package test. This test is a placeholder that
+	// verifies the constant value via the api package's exported test helper.
+	// (See constants_test.go for the actual value assertion.)
+}
+
+// ─── is_key_holder in voice_token payload ────────────────────────────────────
+
+func TestE2EE_VoiceToken_IncludesIsKeyHolder(t *testing.T) {
+	hub, database := newVoiceHub(t)
+	chanID := seedVoiceChan(t, database, "vc-iskh")
+
+	// user1 joins first — should be key holder (lowest ID)
+	user1 := seedVoiceOwner(t, database, "iskh-user1")
+	send1 := make(chan []byte, 32)
+	c1 := ws.NewTestClientWithUser(hub, user1, 0, send1)
+	hub.Register(c1)
+	time.Sleep(20 * time.Millisecond)
+	hub.HandleMessageForTest(c1, voiceJoinMsg(chanID))
+	time.Sleep(50 * time.Millisecond)
+
+	// Check that user1's voice_token has is_key_holder=true
+	msgs1 := drainChan(send1)
+	foundToken := false
+	for _, m := range msgs1 {
+		if extractType(t, m) == "voice_token" {
+			foundToken = true
+			isKH := extractPayloadField(t, m, "is_key_holder")
+			if isKH != true {
+				t.Errorf("user1 voice_token is_key_holder = %v, want true", isKH)
+			}
+		}
+	}
+	if !foundToken {
+		t.Error("user1 did not receive voice_token")
+	}
+
+	// user2 joins — should NOT be key holder
+	user2 := seedVoiceOwner(t, database, "iskh-user2")
+	send2 := make(chan []byte, 32)
+	c2 := ws.NewTestClientWithUser(hub, user2, 0, send2)
+	hub.Register(c2)
+	time.Sleep(20 * time.Millisecond)
+	hub.HandleMessageForTest(c2, voiceJoinMsg(chanID))
+	time.Sleep(50 * time.Millisecond)
+
+	msgs2 := drainChan(send2)
+	foundToken2 := false
+	for _, m := range msgs2 {
+		if extractType(t, m) == "voice_token" {
+			foundToken2 = true
+			isKH := extractPayloadField(t, m, "is_key_holder")
+			if isKH != false {
+				t.Errorf("user2 voice_token is_key_holder = %v, want false", isKH)
+			}
+		}
+	}
+	if !foundToken2 {
+		t.Error("user2 did not receive voice_token")
+	}
+}
+
+// ─── M-5: voiceMu comment includes e2eePubKey ───────────────────────────────
+// This is a code-level check — verified by reading the source.
+// The test ensures the field is guarded properly by testing concurrent access.
+
+func TestE2EE_ConcurrentPubKeyAccess(t *testing.T) {
+	hub, _ := newVoiceHub(t)
+	sendCh := make(chan []byte, 32)
+	c := ws.NewTestClient(hub, 1, sendCh)
+
+	// Concurrent set/get of e2eePubKey should not race.
+	done := make(chan struct{})
+	go func() {
+		for i := 0; i < 100; i++ {
+			ws.SetClientE2EEPubKeyForTest(c, "key-"+string(rune('A'+i%26)))
+		}
+		close(done)
+	}()
+	for i := 0; i < 100; i++ {
+		_ = ws.GetClientE2EEPubKeyForTest(c)
+	}
+	<-done
+}
diff --git a/Server/ws/voice_join.go b/Server/ws/voice_join.go
index 92152141..0dff49fb 100644
--- a/Server/ws/voice_join.go
+++ b/Server/ws/voice_join.go
@@ -158,12 +158,18 @@ func (h *Hub) handleVoiceJoin(ctx context.Context, c *Client, payload json.RawMe
 		// fetch) and falls back to the /livekit proxy for remote clients.
 		// NOTE: E2EE keys are no longer server-generated. Clients exchange
 		// keys via ECDH (voice_e2ee_announce / voice_e2ee_offer messages).
-		c.sendMsg(buildVoiceToken(channelID, token, "/livekit", h.livekit.URL()))
+		// C-2: Include is_key_holder so the client knows whether to initiate
+		// key distribution after connecting to the SFU.
+		isKeyHolder := h.computeIsKeyHolder(channelID, c.userID)
+		c.sendMsg(buildVoiceToken(channelID, token, "/livekit", h.livekit.URL(), isKeyHolder))
 	}
 
 	// Set voice channel on the client AFTER token is sent successfully.
 	c.setVoiceState(channelID, state.JoinedAt)
 
+	// Update key holder map now that this client's voice state is set.
+	h.updateKeyHolder(channelID)
+
 	// Broadcast the joiner's state to all connected clients.
 	h.BroadcastToAll(buildVoiceState(*state))
 
@@ -266,7 +272,7 @@ func (h *Hub) handleVoiceTokenRefresh(_ context.Context, c *Client) {
 
 	// E2EE keys are exchanged client-side via ECDH; token refresh only
 	// provides a new LiveKit access token.
-	c.sendMsg(buildVoiceToken(channelID, token, "/livekit", h.livekit.URL()))
+	c.sendMsg(buildVoiceToken(channelID, token, "/livekit", h.livekit.URL(), h.isVoiceKeyHolder(channelID, c.userID)))
 	slog.Info("voice token refreshed", "user_id", c.userID, "channel_id", channelID)
 }
 
diff --git a/Server/ws/voice_leave.go b/Server/ws/voice_leave.go
index 615175de..ce2b077c 100644
--- a/Server/ws/voice_leave.go
+++ b/Server/ws/voice_leave.go
@@ -34,6 +34,9 @@ func (h *Hub) handleVoiceLeave(ctx context.Context, c *Client) {
 
 	h.BroadcastToAll(buildVoiceLeave(oldChID, c.userID))
 
+	// Re-elect key holder now that this user has left the channel.
+	h.updateKeyHolder(oldChID)
+
 	// E2EE keys are now managed client-side via ECDH key exchange.
 	// When a participant leaves, remaining clients rotate the room key
 	// automatically — the server has no key material to clear.