diff --git a/caddy/caddy_test.go b/caddy/caddy_test.go
index 74fff323ed..5e8b12aa45 100644
--- a/caddy/caddy_test.go
+++ b/caddy/caddy_test.go
@@ -693,7 +693,6 @@ func TestMetrics(t *testing.T) {
 			mercure {
 				transport local
 				anonymous
-				publisher_jwt !ChangeMe!
 			}
 
 			php {
@@ -707,7 +706,6 @@ func TestMetrics(t *testing.T) {
 			mercure {
 				transport local
 				anonymous
-				publisher_jwt !ChangeMe!
 			}
 
 			php {
diff --git a/caddy/frankenphp/Caddyfile b/caddy/frankenphp/Caddyfile
index 0d85fc8019..b0b551c0c6 100644
--- a/caddy/frankenphp/Caddyfile
+++ b/caddy/frankenphp/Caddyfile
@@ -30,10 +30,20 @@
 
 	# Uncomment the following lines to enable Mercure and Vulcain modules
 	#mercure {
-	#	# Publisher JWT key
-	#	publisher_jwt {env.MERCURE_PUBLISHER_JWT_KEY} {env.MERCURE_PUBLISHER_JWT_ALG}
-	#	# Subscriber JWT key
-	#	subscriber_jwt {env.MERCURE_SUBSCRIBER_JWT_KEY} {env.MERCURE_SUBSCRIBER_JWT_ALG}
+	#	# Trusted issuer: binds the iss claim access tokens must carry to its keys.
+	#	# The localhost default suits local development only: in production, set
+	#	# MERCURE_TRUSTED_ISSUERS to the stable identifier of your token issuer
+	#	# (your app's URL for self-issued tokens).
+	#	issuer {$MERCURE_TRUSTED_ISSUERS:https://localhost} {
+	#		# Publisher JWT key
+	#		publisher {
+	#			jwt {env.MERCURE_PUBLISHER_JWT_KEY} {env.MERCURE_PUBLISHER_JWT_ALG}
+	#		}
+	#		# Subscriber JWT key
+	#		subscriber {
+	#			jwt {env.MERCURE_SUBSCRIBER_JWT_KEY} {env.MERCURE_SUBSCRIBER_JWT_ALG}
+	#		}
+	#	}
 	#	# Allow anonymous subscribers (double-check that it's what you want)
 	#	anonymous
 	#	# Enable the subscription API (double-check that it's what you want)
diff --git a/caddy/go.mod b/caddy/go.mod
index 55476af4c7..19f12ba7d4 100644
--- a/caddy/go.mod
+++ b/caddy/go.mod
@@ -11,8 +11,8 @@ require (
 	github.com/caddyserver/certmagic v0.25.4
 	github.com/dunglas/caddy-cbrotli v1.0.1
 	github.com/dunglas/frankenphp v1.12.7
-	github.com/dunglas/mercure v0.24.2
-	github.com/dunglas/mercure/caddy v0.24.2
+	github.com/dunglas/mercure v1.0.0-alpha.3
+	github.com/dunglas/mercure/caddy v1.0.0-alpha.3
 	github.com/dunglas/vulcain/caddy v1.4.2
 	github.com/prometheus/client_golang v1.24.1
 	github.com/spf13/cobra v1.10.2
@@ -60,6 +60,7 @@ require (
 	github.com/dgraph-io/ristretto v0.2.0 // indirect
 	github.com/dgryski/go-farm v0.0.0-20240924180020-3414d57e47da // indirect
 	github.com/dlclark/regexp2/v2 v2.1.1 // indirect
+	github.com/dunglas/go-urlpattern v0.0.0-20260716093037-fb05c4998526 // indirect
 	github.com/dunglas/httpsfv v1.1.0 // indirect
 	github.com/dunglas/skipfilter v1.0.0 // indirect
 	github.com/dunglas/vulcain v1.4.2 // indirect
@@ -117,6 +118,7 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/mschoch/smat v0.2.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/nlnwa/whatwg-url v0.6.2 // indirect
 	github.com/oasdiff/yaml v0.1.0 // indirect
 	github.com/oasdiff/yaml3 v0.0.13 // indirect
 	github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58 // indirect
@@ -214,7 +216,7 @@ require (
 	google.golang.org/api v0.283.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
-	google.golang.org/grpc v1.81.1 // indirect
+	google.golang.org/grpc v1.82.1 // indirect
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
diff --git a/caddy/go.sum b/caddy/go.sum
index c4bf12cf14..4dde30b47d 100644
--- a/caddy/go.sum
+++ b/caddy/go.sum
@@ -93,6 +93,7 @@ github.com/aws/smithy-go v1.25.1 h1:J8ERsGSU7d+aCmdQur5Txg6bVoYelvQJgtZehD12GkI=
 github.com/aws/smithy-go v1.25.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bits-and-blooms/bitset v1.20.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
 github.com/bits-and-blooms/bitset v1.24.6 h1:qcrftZUVBIwfs+m+nhoCBAPT+ZPZZjti8SbHbDQQkZ4=
 github.com/bits-and-blooms/bitset v1.24.6/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
 github.com/caddyserver/caddy/v2 v2.11.4 h1:XKxkMTgNSizEvKG6QHue6cAsFOteU2qA61w2tKkCWi0=
@@ -152,12 +153,18 @@ github.com/dlclark/regexp2/v2 v2.1.1 h1:LCUGyd9Wf+r+VVOl8Ny38JTpWJcAsdVnCIuhhtth
 github.com/dlclark/regexp2/v2 v2.1.1/go.mod h1:avUrQvPaLz2DrFNHJF0taWAFFX2C1GMSSoeiqFjcBmU=
 github.com/dunglas/caddy-cbrotli v1.0.1 h1:mkg7EB1GmoyfBt3kY3mq4o/0bfnBeq7ZLQjmVmdBE3Y=
 github.com/dunglas/caddy-cbrotli v1.0.1/go.mod h1:uXABy3tjy1FABF+3JWKVh1ajFvIO/kfpwHaeZGSBaAY=
+github.com/dunglas/go-urlpattern v0.0.0-20260716093037-fb05c4998526 h1:biCci7wlx/ChMqOkoUw6FPrhEZYRpulBZ+fO4Geo5Xs=
+github.com/dunglas/go-urlpattern v0.0.0-20260716093037-fb05c4998526/go.mod h1:9qyjDljBPOWyWCGz7vo3Ek7cdnoG/DVk0Ucle7gWVS8=
 github.com/dunglas/httpsfv v1.1.0 h1:Jw76nAyKWKZKFrpMMcL76y35tOpYHqQPzHQiwDvpe54=
 github.com/dunglas/httpsfv v1.1.0/go.mod h1:zID2mqw9mFsnt7YC3vYQ9/cjq30q41W+1AnDwH8TiMg=
 github.com/dunglas/mercure v0.24.2 h1:0uKT5XR/tkaGWhwUlXqjWek/0w+dY1n8HEY9Q8YB0hw=
 github.com/dunglas/mercure v0.24.2/go.mod h1:BAaiHFKr5+rS5SUP1tJBRXlCjPWZmzy1n0BDlVJnWzY=
+github.com/dunglas/mercure v1.0.0-alpha.3 h1:e+u4JpBTMNv0sd3igwSo5RzqSVWuo3E6HOMonhfTP94=
+github.com/dunglas/mercure v1.0.0-alpha.3/go.mod h1:7i/xv2fXgCRgoJe/Yj+FYY7YV4VdMGkCpFNJEfFfqCo=
 github.com/dunglas/mercure/caddy v0.24.2 h1:QjdJXvyJQaOtrt/LSk4QoCdFmRbyTVMl72bqmAGFPxw=
 github.com/dunglas/mercure/caddy v0.24.2/go.mod h1:9e8vEukfn1eq0iHCsBwWWSsHBlNt660L2wUsisnOOWM=
+github.com/dunglas/mercure/caddy v1.0.0-alpha.3 h1:l5cfLXIjKsZqNsMYYnYUwk3QYFMxDWb06P9HOn/HL64=
+github.com/dunglas/mercure/caddy v1.0.0-alpha.3/go.mod h1:jm1xTnsY4vY20Rc4dDYZI2MNY+IaVQmi5opHWOiuUgs=
 github.com/dunglas/skipfilter v1.0.0 h1:JG9SgGg4n6BlFwuTYzb9RIqjH7PfwszvWehanrYWPF4=
 github.com/dunglas/skipfilter v1.0.0/go.mod h1:ryhr8j7CAHSjzeN7wI6YEuwoArQ3OQmRqWWVCEAfb9w=
 github.com/dunglas/vulcain v1.4.2 h1:Y5iOA/wq8TJuxBPg9tIbTjgoaCrK0hqOETOb3WN1a8U=
@@ -313,6 +320,8 @@ github.com/mschoch/smat v0.2.0 h1:8imxQsjDm8yFEAVBe7azKmKSgzSkZXDuKkSq9374khM=
 github.com/mschoch/smat v0.2.0/go.mod h1:kc9mz7DoBKqDyiRL7VZN8KvXQMWeTaVnttLRXOlotKw=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/nlnwa/whatwg-url v0.6.2 h1:jU61lU2ig4LANydbEJmA2nPrtCGiKdtgT0rmMd2VZ/Q=
+github.com/nlnwa/whatwg-url v0.6.2/go.mod h1:x0FPXJzzOEieQtsBT/AKvbiBbQ46YlL6Xa7m02M1ECk=
 github.com/oasdiff/yaml v0.1.0 h1:0bqZjfKc/8S9urj4JuwepX41WX9EoA6ifhU3SV06cXg=
 github.com/oasdiff/yaml v0.1.0/go.mod h1:kOlRmMdL2X3vucLCEQO5u61SU22RysnfXvcttrZA1O0=
 github.com/oasdiff/yaml3 v0.0.13 h1:06svmvOHOVBqF81+sY2EUScvUI/iS/vl2VIeUUxZQwg=
@@ -551,6 +560,7 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
 golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M=
 golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
 golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
@@ -573,6 +583,7 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
 golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
 golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
@@ -583,6 +594,7 @@ golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
 golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
@@ -600,6 +612,7 @@ golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
@@ -611,6 +624,7 @@ golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
+golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
 golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
 golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
 golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
@@ -622,6 +636,7 @@ golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
 golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
 golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
 golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
@@ -648,6 +663,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
 google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
+google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
+google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2 h1:rgSNvqscFZ1JgV/4wH5GOsZFSFkR2Eua9As3KIr2LlM=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2/go.mod h1:iMEtFwDlAhjDU9L5mY6U1XLwlIId/G3h+QcBHDIvrJ8=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
diff --git a/caddy/hotreload.go b/caddy/hotreload.go
index 4b9c0ebe69..ddba50fb70 100644
--- a/caddy/hotreload.go
+++ b/caddy/hotreload.go
@@ -49,7 +49,9 @@ func (f *FrankenPHPModule) configureHotReload(app *FrankenPHPApp) error {
 	}
 
 	app.opts = append(app.opts, frankenphp.WithHotReload(f.HotReload.Topic, f.mercureHub, f.HotReload.Watch))
-	f.preparedEnv["FRANKENPHP_HOT_RELOAD\x00"] = "/.well-known/mercure?topic=" + url.QueryEscape(f.HotReload.Topic)
+	// "match" is the exact topic matcher of the Mercure protocol, the "topic"
+	// parameter it replaces is only honored in compatibility mode.
+	f.preparedEnv["FRANKENPHP_HOT_RELOAD\x00"] = "/.well-known/mercure?match=" + url.QueryEscape(f.HotReload.Topic)
 
 	return nil
 }
diff --git a/caddy/hotreload_test.go b/caddy/hotreload_test.go
index 9eed620453..4324dc7d63 100644
--- a/caddy/hotreload_test.go
+++ b/caddy/hotreload_test.go
@@ -20,7 +20,7 @@ import (
 func TestHotReload(t *testing.T) {
 	const topic = "https://frankenphp.dev/hot-reload/test"
 
-	u := "/.well-known/mercure?topic=" + url.QueryEscape(topic)
+	u := "/.well-known/mercure?match=" + url.QueryEscape(topic)
 
 	tmpDir := t.TempDir()
 	indexFile := filepath.Join(tmpDir, "index.php")
@@ -40,7 +40,6 @@ func TestHotReload(t *testing.T) {
 		http://localhost:`+testPort+` {
 			mercure {
 				transport local
-				subscriber_jwt TestKey 
 				anonymous
 			}
 
diff --git a/caddy/mercure.go b/caddy/mercure.go
index 502f32895c..9bc780be02 100644
--- a/caddy/mercure.go
+++ b/caddy/mercure.go
@@ -48,16 +48,32 @@ func createMercureRoute() (caddyhttp.Route, error) {
 		return caddyhttp.Route{}, errors.New(`the "MERCURE_SUBSCRIBER_JWT_KEY" environment variable must be set to use the Mercure.rocks hub`)
 	}
 
+	// The protocol requires access tokens to name their issuer, so the keys are
+	// bound to one trusted issuer instead of being set globally.
+	issuer := os.Getenv("MERCURE_TRUSTED_ISSUERS")
+	if issuer == "" {
+		issuer = "https://localhost"
+	}
+
 	mercureRoute := caddyhttp.Route{
 		HandlersRaw: []json.RawMessage{caddyconfig.JSONModuleObject(
 			mercureCaddy.Mercure{
-				PublisherJWT: mercureCaddy.JWTConfig{
-					Alg: os.Getenv("MERCURE_PUBLISHER_JWT_ALG"),
-					Key: mercurePublisherJwtKey,
-				},
-				SubscriberJWT: mercureCaddy.JWTConfig{
-					Alg: os.Getenv("MERCURE_SUBSCRIBER_JWT_ALG"),
-					Key: mercureSubscriberJwtKey,
+				Issuers: []mercureCaddy.IssuerConfig{
+					{
+						Identifier: issuer,
+						Publisher: mercureCaddy.VerifierConfig{
+							JWT: mercureCaddy.JWTConfig{
+								Alg: os.Getenv("MERCURE_PUBLISHER_JWT_ALG"),
+								Key: mercurePublisherJwtKey,
+							},
+						},
+						Subscriber: mercureCaddy.VerifierConfig{
+							JWT: mercureCaddy.JWTConfig{
+								Alg: os.Getenv("MERCURE_SUBSCRIBER_JWT_ALG"),
+								Key: mercureSubscriberJwtKey,
+							},
+						},
+					},
 				},
 			},
 			"handler",
diff --git a/docs/mercure.md b/docs/mercure.md
index ebf6541e50..abccd70be6 100644
--- a/docs/mercure.md
+++ b/docs/mercure.md
@@ -22,11 +22,16 @@ Here is a minimal example of a `Caddyfile` enabling both FrankenPHP and the Merc
 localhost
 
 mercure {
-    # The secret key used to sign the JWT tokens for publishers
-    publisher_jwt !ChangeThisMercureHubJWTSecretKey!
-    # When publisher_jwt is set, you must set subscriber_jwt too!
-    subscriber_jwt !ChangeThisMercureHubJWTSecretKey!
-    # Allows anonymous subscribers (without JWT)
+    # The issuer of the access tokens, and the keys verifying them
+    issuer https://localhost {
+        publisher {
+            jwt !ChangeThisMercureHubJWTSecretKey!
+        }
+        subscriber {
+            jwt !ChangeThisMercureHubJWTSecretKey!
+        }
+    }
+    # Allows anonymous subscribers (without access token)
     anonymous
 }
 
@@ -34,6 +39,9 @@ root public/
 php_server
 ```
 
+Access tokens must carry the identifier of the `issuer` they were signed by in their `iss` claim.
+`mercure_publish()` doesn't need any token: it publishes directly, in-process.
+
 > [!TIP]
 >
 > The [sample `Caddyfile`](https://github.com/php/frankenphp/blob/main/caddy/frankenphp/Caddyfile)
@@ -52,7 +60,7 @@ To subscribe to updates, use the native [`EventSource`](https://developer.mozill
 <!doctype html>
 <title>Mercure Example</title>
 <script>
-  const eventSource = new EventSource("/.well-known/mercure?topic=my-topic");
+  const eventSource = new EventSource("/.well-known/mercure?match=my-topic");
   eventSource.onmessage = function (event) {
     console.log("New message:", event.data);
   };
@@ -79,11 +87,23 @@ The full function signature is:
 
 ```php
 /**
- * @param string|string[] $topics
+ * @param string|string[] $topics The first topic is the canonical one, the others are alternate topics
  */
 function mercure_publish(string|array $topics, string $data = '', bool $private = false, ?string $id = null, ?string $type = null, ?int $retry = null): string {}
 ```
 
+Subscribers matching the canonical topic or any of the alternate topics receive the update.
+The returned string is the ID of the update, to be used as `Last-Event-ID` to resume a stream.
+
+`mercure_publish()` throws a `ValueError` when the update violates the protocol, notably when:
+
+- a topic addresses the `/.well-known/mercure` namespace, which is reserved for the hub, or is `*`, which is reserved for the wildcard matcher;
+- `$id` starts with `#`, is `earliest`, or contains control characters;
+- `$type` is `mercure`, which is reserved for the events generated by the hub, or contains control characters;
+- `$data` isn't valid UTF-8.
+
+A `RuntimeException` is thrown when no hub is configured, or when the hub fails to dispatch the update.
+
 ### Using `file_get_contents()`
 
 To dispatch an update to connected subscribers, send an authenticated POST request to the Mercure hub with the `topic` and `data` parameters:
@@ -92,11 +112,12 @@ To dispatch an update to connected subscribers, send an authenticated POST reque
 <?php
 // public/publish.php
 
-const JWT = 'eyJhbGciOiJIUzI1NiJ9.eyJtZXJjdXJlIjp7InB1Ymxpc2giOlsiKiJdfX0.PXwpfIGng6KObfZlcOXvcnWCJOWTFLtswGI5DZuWSK4';
+// An access token signed with the key of the "issuer" configured in the Caddyfile
+$jwt = generate_access_token();
 
 $updateID = file_get_contents('https://localhost/.well-known/mercure', context: stream_context_create(['http' => [
     'method'  => 'POST',
-    'header'  => "Content-type: application/x-www-form-urlencoded\r\nAuthorization: Bearer " . JWT,
+    'header'  => "Content-type: application/x-www-form-urlencoded\r\nAuthorization: Bearer " . $jwt,
     'content' => http_build_query([
         'topic' => 'my-topic',
         'data' => json_encode(['key' => 'value']),
@@ -107,19 +128,40 @@ $updateID = file_get_contents('https://localhost/.well-known/mercure', context:
 error_log("update $updateID published", 4);
 ```
 
-The key passed as parameter of the `mercure.publisher_jwt` option in the `Caddyfile` must be used to sign the JWT token used in the `Authorization` header.
+The token is an [OAuth 2.0 access token](https://www.rfc-editor.org/rfc/rfc9068), signed with the key of the `issuer` block of the `Caddyfile`.
+Its header must contain `"typ": "at+jwt"`, and its payload must grant the `publish` action on every topic of the update:
+
+```json
+{
+  "iss": "https://localhost",
+  "aud": "https://localhost/.well-known/mercure",
+  "exp": 4102444800,
+  "authorization_details": [
+    {
+      "type": "https://mercure.rocks/authorization-detail",
+      "actions": ["publish"],
+      "topics": [{ "match": "my-topic" }]
+    }
+  ]
+}
+```
 
-The JWT must include a `mercure` claim with a `publish` permission for the topics you want to publish to.
-See [the Mercure documentation](https://mercure.rocks/spec#publishers) about authorization.
+`iss` must be the identifier of the `issuer` block, and `aud` the URL of the hub.
+See [the Mercure documentation](https://mercure.rocks/docs/concepts/authorization) about authorization.
 
-To generate your own tokens, you can use [this jwt.io link](https://www.jwt.io/#token=eyJhbGciOiJIUzI1NiJ9.eyJtZXJjdXJlIjp7InB1Ymxpc2giOlsiKiJdfX0.PXwpfIGng6KObfZlcOXvcnWCJOWTFLtswGI5DZuWSK4),
-but for production apps, it's recommended to use short-lived tokens generated dynamically using a trusted [JWT library](https://www.jwt.io/libraries?programming_language=php).
+Generate these tokens dynamically, using a trusted [JWT library](https://www.jwt.io/libraries?programming_language=php): the protocol requires an expiration date, so they cannot be hardcoded.
+
+> [!WARNING]
+>
+> The tokens of the Mercure protocol 0.x, using a `mercure` claim, are rejected.
+> FrankenPHP is built without the compatibility build tags of the hub, so `protocol_version_compatibility` cannot re-enable them.
 
 ### Using Symfony Mercure
 
 Alternatively, you can use the [Symfony Mercure Component](https://symfony.com/components/Mercure), a standalone PHP library.
 
 This library handles the JWT generation, update publishing as well as cookie-based authorization for subscribers.
+Support for the Mercure protocol 1.0 requires symfony/mercure 0.8 or later.
 
 First, install the library using Composer:
 
@@ -135,11 +177,19 @@ Then, you can use it like this:
 
 require __DIR__ . '/../vendor/autoload.php';
 
-const JWT_SECRET = '!ChangeThisMercureHubJWTSecretKey!'; // Must be the same as mercure.publisher_jwt in Caddyfile
-
-// Set up the JWT token provider
-$jwFactory = new \Symfony\Component\Mercure\Jwt\LcobucciFactory(JWT_SECRET);
-$provider = new \Symfony\Component\Mercure\Jwt\FactoryTokenProvider($jwFactory, publish: ['*']);
+const JWT_SECRET = '!ChangeThisMercureHubJWTSecretKey!'; // Must be the same as the publisher jwt in Caddyfile
+
+// Set up the JWT token provider, issuing Mercure 1.0 access tokens
+$jwFactory = new \Symfony\Component\Mercure\Jwt\LcobucciFactory(
+    JWT_SECRET,
+    jwtLifetime: 3600,
+    protocolVersion: \Symfony\Component\Mercure\ProtocolVersion::V1,
+);
+$provider = new \Symfony\Component\Mercure\Jwt\FactoryTokenProvider(
+    $jwFactory,
+    [new \Symfony\Component\Mercure\Jwt\Grant([\Symfony\Component\Mercure\Jwt\Grant::ACTION_PUBLISH], ['*'])],
+    ['iss' => 'https://localhost', 'aud' => 'https://localhost/.well-known/mercure'],
+);
 
 $hub = new \Symfony\Component\Mercure\Hub('https://localhost/.well-known/mercure', $provider);
 // Serialize the update, and dispatch it to the hub, that will broadcast it to the clients
diff --git a/frankenphp.c b/frankenphp.c
index b15507f69d..5afb8133e8 100644
--- a/frankenphp.c
+++ b/frankenphp.c
@@ -976,24 +976,40 @@ PHP_FUNCTION(mercure_publish) {
     RETURN_THROWS();
   }
 
+  /* The protocol only allows digits in the "retry" field. */
+  if (retry < 0) {
+    zend_argument_value_error(6, "must be greater than or equal to 0");
+    RETURN_THROWS();
+  }
+
   struct go_mercure_publish_return result = go_mercure_publish(
       frankenphp_thread_index(), topics, data, private, id, type, retry);
 
-  switch (result.r1) {
-  case 0:
+  switch (result.r2) {
+  case FRANKENPHP_MERCURE_OK:
+    if (result.r0 == NULL) {
+      RETURN_EMPTY_STRING();
+    }
+
     RETURN_STR(result.r0);
-  case 1:
+  case FRANKENPHP_MERCURE_NO_HUB:
     zend_throw_exception(spl_ce_RuntimeException, "No Mercure hub configured",
                          0);
     RETURN_THROWS();
-  case 2:
-    zend_throw_exception(spl_ce_RuntimeException, "Publish failed", 0);
+  case FRANKENPHP_MERCURE_INVALID_UPDATE:
+    zend_value_error("%s", result.r1);
+    free(result.r1);
+    RETURN_THROWS();
+  case FRANKENPHP_MERCURE_PUBLISH_FAILED:
+    zend_throw_exception_ex(spl_ce_RuntimeException, 0, "Publish failed: %s",
+                            result.r1);
+    free(result.r1);
+    RETURN_THROWS();
+  case FRANKENPHP_MERCURE_UNSUPPORTED:
+    zend_throw_exception(spl_ce_RuntimeException,
+                         "FrankenPHP not built with Mercure support", 0);
     RETURN_THROWS();
   }
-
-  zend_throw_exception(spl_ce_RuntimeException,
-                       "FrankenPHP not built with Mercure support", 0);
-  RETURN_THROWS();
 }
 
 PHP_FUNCTION(frankenphp_log) {
diff --git a/frankenphp.h b/frankenphp.h
index 99ac0ab7ec..c5cc7b11f1 100644
--- a/frankenphp.h
+++ b/frankenphp.h
@@ -201,6 +201,16 @@ size_t frankenphp_get_thread_memory_usage(uintptr_t thread_index);
 void frankenphp_force_kill_thread(force_kill_slot slot);
 void frankenphp_release_thread_for_kill(force_kill_slot slot);
 
+/* Outcome of go_mercure_publish(). INVALID_UPDATE and PUBLISH_FAILED carry a
+ * malloc'ed message the caller must free. */
+typedef enum {
+  FRANKENPHP_MERCURE_OK = 0,
+  FRANKENPHP_MERCURE_NO_HUB = 1,
+  FRANKENPHP_MERCURE_INVALID_UPDATE = 2,
+  FRANKENPHP_MERCURE_PUBLISH_FAILED = 3,
+  FRANKENPHP_MERCURE_UNSUPPORTED = 4,
+} frankenphp_mercure_status;
+
 void register_extensions(zend_module_entry **m, int len);
 
 #endif
diff --git a/frankenphp.stub.php b/frankenphp.stub.php
index d6c85aa05f..d61397caaa 100644
--- a/frankenphp.stub.php
+++ b/frankenphp.stub.php
@@ -45,7 +45,7 @@ function frankenphp_response_headers(): array|bool {}
 function apache_response_headers(): array|bool {}
 
 /**
- * @param string|string[] $topics
+ * @param string|string[] $topics The first topic is the canonical one, the others are alternate topics
  */
 function mercure_publish(string|array $topics, string $data = '', bool $private = false, ?string $id = null, ?string $type = null, ?int $retry = null): string {}
 
diff --git a/go.mod b/go.mod
index 081e2c61fe..a91c1af9b4 100644
--- a/go.mod
+++ b/go.mod
@@ -6,7 +6,7 @@ retract v1.0.0-rc.1 // Human error
 
 require (
 	github.com/Masterminds/sprig/v3 v3.3.0
-	github.com/dunglas/mercure v0.24.2
+	github.com/dunglas/mercure v1.0.0-alpha.3
 	github.com/e-dant/watcher v0.0.0-20260223030516-06f84a1314be
 	github.com/maypok86/otter/v2 v2.3.0
 	github.com/prometheus/client_golang v1.24.1
@@ -24,6 +24,7 @@ require (
 	github.com/bits-and-blooms/bitset v1.24.6 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/dunglas/go-urlpattern v0.0.0-20260716093037-fb05c4998526 // indirect
 	github.com/dunglas/skipfilter v1.0.0 // indirect
 	github.com/felixge/httpsnoop v1.1.0 // indirect
 	github.com/fsnotify/fsnotify v1.10.1 // indirect
@@ -39,6 +40,7 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/mschoch/smat v0.2.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/nlnwa/whatwg-url v0.6.2 // indirect
 	github.com/pelletier/go-toml/v2 v2.4.3 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
@@ -60,6 +62,7 @@ require (
 	go.opentelemetry.io/otel/trace v1.45.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/crypto v0.54.0 // indirect
+	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
 	golang.org/x/sys v0.47.0 // indirect
 	golang.org/x/text v0.40.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
diff --git a/go.sum b/go.sum
index cc2da78b2e..27b02f3413 100644
--- a/go.sum
+++ b/go.sum
@@ -12,14 +12,19 @@ github.com/RoaringBitmap/roaring/v2 v2.24.0 h1:zQkkBZtG3WRP4j+P3A5DO221SvL1Br88T
 github.com/RoaringBitmap/roaring/v2 v2.24.0/go.mod h1:SfT3of9nYh3vis1dIbCj4Yw6KQGujTN+f345nrN/0JA=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bits-and-blooms/bitset v1.20.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
 github.com/bits-and-blooms/bitset v1.24.6 h1:qcrftZUVBIwfs+m+nhoCBAPT+ZPZZjti8SbHbDQQkZ4=
 github.com/bits-and-blooms/bitset v1.24.6/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dunglas/go-urlpattern v0.0.0-20260716093037-fb05c4998526 h1:biCci7wlx/ChMqOkoUw6FPrhEZYRpulBZ+fO4Geo5Xs=
+github.com/dunglas/go-urlpattern v0.0.0-20260716093037-fb05c4998526/go.mod h1:9qyjDljBPOWyWCGz7vo3Ek7cdnoG/DVk0Ucle7gWVS8=
 github.com/dunglas/mercure v0.24.2 h1:0uKT5XR/tkaGWhwUlXqjWek/0w+dY1n8HEY9Q8YB0hw=
 github.com/dunglas/mercure v0.24.2/go.mod h1:BAaiHFKr5+rS5SUP1tJBRXlCjPWZmzy1n0BDlVJnWzY=
+github.com/dunglas/mercure v1.0.0-alpha.3 h1:e+u4JpBTMNv0sd3igwSo5RzqSVWuo3E6HOMonhfTP94=
+github.com/dunglas/mercure v1.0.0-alpha.3/go.mod h1:7i/xv2fXgCRgoJe/Yj+FYY7YV4VdMGkCpFNJEfFfqCo=
 github.com/dunglas/skipfilter v1.0.0 h1:JG9SgGg4n6BlFwuTYzb9RIqjH7PfwszvWehanrYWPF4=
 github.com/dunglas/skipfilter v1.0.0/go.mod h1:ryhr8j7CAHSjzeN7wI6YEuwoArQ3OQmRqWWVCEAfb9w=
 github.com/e-dant/watcher v0.0.0-20260223030516-06f84a1314be h1:vqHrvilasyJcnru/0Z4FoojsQJUIfXGVplte7JtupfY=
@@ -40,6 +45,7 @@ github.com/gofrs/uuid/v5 v5.5.1 h1:z1Ce19/JwNidXpy3tOQc3241lnJLKdKyq/xlNvlD4Ng=
 github.com/gofrs/uuid/v5 v5.5.1/go.mod h1:bbAA98EoIlxyRHIVg6ektCSsZ5n8mSbwgEhvhMYlZgg=
 github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
 github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -68,6 +74,8 @@ github.com/mschoch/smat v0.2.0 h1:8imxQsjDm8yFEAVBe7azKmKSgzSkZXDuKkSq9374khM=
 github.com/mschoch/smat v0.2.0/go.mod h1:kc9mz7DoBKqDyiRL7VZN8KvXQMWeTaVnttLRXOlotKw=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/nlnwa/whatwg-url v0.6.2 h1:jU61lU2ig4LANydbEJmA2nPrtCGiKdtgT0rmMd2VZ/Q=
+github.com/nlnwa/whatwg-url v0.6.2/go.mod h1:x0FPXJzzOEieQtsBT/AKvbiBbQ46YlL6Xa7m02M1ECk=
 github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdDPYVpY=
 github.com/pelletier/go-toml/v2 v2.4.3/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
@@ -104,6 +112,7 @@ github.com/unrolled/secure v1.17.0 h1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbW
 github.com/unrolled/secure v1.17.0/go.mod h1:BmF5hyM6tXczk3MpQkFf1hpKSRqCyhqcbiQtiAF7+40=
 github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=
 github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.etcd.io/bbolt v1.5.0 h1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P/bD4lxU=
 go.etcd.io/bbolt v1.5.0/go.mod h1:mkltfYE5aUHQxUct9N9V+Kp7aSjFqjgrhcXIS70Lrdk=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
@@ -122,16 +131,81 @@ go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
+golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
 golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
 golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
 golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
 golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
 golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
+golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
+golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
 golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
 golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
diff --git a/mercure-skip.go b/mercure-skip.go
index 26691068d6..bd2e78053f 100644
--- a/mercure-skip.go
+++ b/mercure-skip.go
@@ -3,6 +3,7 @@
 package frankenphp
 
 // #include <stdint.h>
+// #include "frankenphp.h"
 // #include <php.h>
 import "C"
 
@@ -10,8 +11,8 @@ type mercureContext struct {
 }
 
 //export go_mercure_publish
-func go_mercure_publish(threadIndex C.uintptr_t, topics *C.struct__zval_struct, data *C.zend_string, private bool, id, typ *C.zend_string, retry uint64) (generatedID *C.zend_string, error C.short) {
-	return nil, 3
+func go_mercure_publish(threadIndex C.uintptr_t, topics *C.struct__zval_struct, data *C.zend_string, private bool, id, typ *C.zend_string, retry uint64) (generatedID *C.zend_string, errorMessage *C.char, status C.frankenphp_mercure_status) {
+	return nil, nil, C.FRANKENPHP_MERCURE_UNSUPPORTED
 }
 
 func (w *worker) configureMercure(_ *workerOpt) {
diff --git a/mercure.go b/mercure.go
index d7cf33609e..0b4a008ad4 100644
--- a/mercure.go
+++ b/mercure.go
@@ -18,7 +18,7 @@ type mercureContext struct {
 }
 
 //export go_mercure_publish
-func go_mercure_publish(threadIndex C.uintptr_t, topics *C.struct__zval_struct, data *C.zend_string, private bool, id, typ *C.zend_string, retry uint64) (generatedID *C.zend_string, error C.short) {
+func go_mercure_publish(threadIndex C.uintptr_t, topics *C.struct__zval_struct, data *C.zend_string, private bool, id, typ *C.zend_string, retry uint64) (generatedID *C.zend_string, errorMessage *C.char, status C.frankenphp_mercure_status) {
 	thread := phpThreads[threadIndex]
 	ctx := thread.context()
 	fc := thread.frankenPHPContext()
@@ -28,7 +28,7 @@ func go_mercure_publish(threadIndex C.uintptr_t, topics *C.struct__zval_struct,
 			fc.logger.LogAttrs(ctx, slog.LevelError, "No Mercure hub configured")
 		}
 
-		return nil, 1
+		return nil, nil, C.FRANKENPHP_MERCURE_NO_HUB
 	}
 
 	u := &mercure.Update{
@@ -49,11 +49,7 @@ func go_mercure_publish(threadIndex C.uintptr_t, topics *C.struct__zval_struct,
 	case C.IS_ARRAY:
 		ts, err := GoPackedArray[string](unsafe.Pointer(*(**C.zend_array)(unsafe.Pointer(&topics.value[0]))))
 		if err != nil {
-			if fc.logger.Enabled(ctx, slog.LevelError) {
-				fc.logger.LogAttrs(ctx, slog.LevelError, "invalid topics type", slog.Any("error", err))
-			}
-
-			return nil, 1
+			return nil, C.CString(err.Error()), C.FRANKENPHP_MERCURE_INVALID_UPDATE
 		}
 
 		u.Topics = ts
@@ -62,15 +58,21 @@ func go_mercure_publish(threadIndex C.uintptr_t, topics *C.struct__zval_struct,
 		panic("invalid topics type")
 	}
 
+	// The protocol constrains topics, id, type and data: report the violations
+	// as argument errors instead of as a failed publication.
+	if err := u.Validate(); err != nil {
+		return nil, C.CString(err.Error()), C.FRANKENPHP_MERCURE_INVALID_UPDATE
+	}
+
 	if err := fc.mercureHub.Publish(ctx, u); err != nil {
 		if fc.logger.Enabled(ctx, slog.LevelError) {
 			fc.logger.LogAttrs(ctx, slog.LevelError, "Unable to publish Mercure update", slog.Any("error", err))
 		}
 
-		return nil, 2
+		return nil, C.CString(err.Error()), C.FRANKENPHP_MERCURE_PUBLISH_FAILED
 	}
 
-	return (*C.zend_string)(PHPString(u.ID, false)), 0
+	return (*C.zend_string)(PHPString(u.ID, false)), nil, C.FRANKENPHP_MERCURE_OK
 }
 
 func (w *worker) configureMercure(o *workerOpt) {
diff --git a/mercure_test.go b/mercure_test.go
index 857e14bd5d..f3046a453d 100644
--- a/mercure_test.go
+++ b/mercure_test.go
@@ -28,5 +28,8 @@ func testMercurePublish(t *testing.T, opts *testOptions) {
 		body, _ := testGet(fmt.Sprintf("https://example.com/mercure-publish.php?i=%d", i), handler, t)
 		assert.Contains(t, body, "update 1: ")
 		assert.Contains(t, body, "update 2: ")
+		// Updates rejected by the protocol are reported as argument errors.
+		assert.Contains(t, body, `error 1: "/.well-known/mercure/subscriptions"`)
+		assert.Contains(t, body, "error 2: mercure_publish(): Argument #6 ($retry) must be greater than or equal to 0")
 	}, opts)
 }
diff --git a/testdata/mercure-publish.php b/testdata/mercure-publish.php
index fcdcb95021..07933049da 100644
--- a/testdata/mercure-publish.php
+++ b/testdata/mercure-publish.php
@@ -5,4 +5,16 @@
 return function () {
 	echo "update 1: " . mercure_publish('foo', 'bar', true, 'myid', 'mytype', 10) . "\n";
 	echo "update 2: " . mercure_publish(['baz', 'bar']) . "\n";
+
+	try {
+		mercure_publish('/.well-known/mercure/subscriptions');
+	} catch (ValueError $e) {
+		echo "error 1: " . $e->getMessage() . "\n";
+	}
+
+	try {
+		mercure_publish('foo', retry: -1);
+	} catch (ValueError $e) {
+		echo "error 2: " . $e->getMessage() . "\n";
+	}
 };