Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

No response

Describe the bug

The PATCH {{baseUrl}}/admin/clients/{id} endpoint loses the RegistrationAccessTokenSignature when marshaling the client to JSON, permanently invalidating the registration access token. This makes it impossible to manage the client via the Dynamic Client Registration endpoints GET /oauth2/register/{id}, PUT /oauth2/register/{id} and DELETE /oauth2/register/{id}.

Reproducing the bug

1. Create an OAuth2 client using the OIDC Dynamic Client Registration API.
2. Call the PATCH /admin/clients/{id} endpoint and update the client.
3. Attempt to manage the client using the Dynamic Client Registration API (GET, PUT, or DELETE).

Relevant log output

Relevant configuration

oidc:
  dynamic_client_registration:
    enabled: true

Version

25.4.0

On which operating system are you observing this issue?

Linux

In which environment are you deploying?

Kubernetes with Helm

Additional Context

No response