diff --git a/packages/iios-kernel-client/package.json b/packages/iios-kernel-client/package.json
index 2dbf438..f901a99 100644
--- a/packages/iios-kernel-client/package.json
+++ b/packages/iios-kernel-client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@insignia/iios-kernel-client",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "type": "module",
   "main": "dist/index.js",
   "module": "dist/index.js",
diff --git a/packages/iios-kernel-client/src/rest.ts b/packages/iios-kernel-client/src/rest.ts
index a355529..b0d98cd 100644
--- a/packages/iios-kernel-client/src/rest.ts
+++ b/packages/iios-kernel-client/src/rest.ts
@@ -4,6 +4,8 @@ import type { Message, InboxItem, InboxState, Ticket, TicketState, CallbackReque
 export interface RestConfig {
   serviceUrl: string;
   token?: string;
+  /** Extra headers sent on every request — e.g. `x-context-attestation` (the July 12 trust proof). */
+  headers?: Record<string, string>;
 }
 
 /** REST/polling client for kernel reads and the native-send fallback. */
@@ -15,7 +17,7 @@ export class RestClient {
   }
 
   private headers(extra: Record<string, string> = {}): Record<string, string> {
-    const h: Record<string, string> = { 'content-type': 'application/json', ...extra };
+    const h: Record<string, string> = { 'content-type': 'application/json', ...this.config.headers, ...extra };
     if (this.config.token) h.authorization = `Bearer ${this.config.token}`;
     return h;
   }