diff --git a/client/internal/pqkem/convergence.go b/client/internal/pqkem/convergence.go
index 76a061bee..f30695426 100644
--- a/client/internal/pqkem/convergence.go
+++ b/client/internal/pqkem/convergence.go
@@ -160,7 +160,7 @@ func (m *Manager) processOffer(remoteID RemoteID, o *OfferMsg, via string) ([]by
 	ex.state = stateAwaitingAck
 	ex.lastSent = raw
 	gen := ex.gen
-	m.psks[remoteID] = psk
+	m.commitPSKLocked(remoteID, psk)
 	m.capable[remoteID] = true // a real KEM offer proves the peer runs the exchange
 	m.mu.Unlock()
 
@@ -255,7 +255,7 @@ func (m *Manager) processAnswer(remoteID RemoteID, a *AnswerMsg, via string) err
 	cur.state = stateAwaitingRekey
 	m.established[remoteID] = true
 	m.failures[remoteID] = 0
-	m.psks[remoteID] = psk
+	m.commitPSKLocked(remoteID, psk)
 	m.capable[remoteID] = true // a real KEM answer proves the peer runs the exchange
 	m.mu.Unlock()
 
diff --git a/client/internal/pqkem/manager.go b/client/internal/pqkem/manager.go
index 958b04748..a779d0443 100644
--- a/client/internal/pqkem/manager.go
+++ b/client/internal/pqkem/manager.go
@@ -567,9 +567,20 @@ func (m *Manager) OnDataPathDown(remoteID RemoteID) {}
 
 // ---- internals ----
 
-// pushDataPath resolves the peer's endpoint and sends over the data-path transport,
-// erroring if the peer is unknown or no transport is set.
+// commitPSKLocked records a freshly derived PSK as the peer's current one. Assumes m.mu
+// is held.
+func (m *Manager) commitPSKLocked(remoteID RemoteID, psk PSK) {
+	m.psks[remoteID] = psk
+}
+
+// pushDataPath sends a message to the peer over the data-path transport.
 func (m *Manager) pushDataPath(remoteID RemoteID, msg []byte) error {
+	return m.sendDataPath(remoteID, msg)
+}
+
+// sendDataPath resolves the peer's endpoint and sends over the data-path transport,
+// erroring if the peer is unknown or no transport is set.
+func (m *Manager) sendDataPath(remoteID RemoteID, msg []byte) error {
 	m.mu.Lock()
 	ep, ok := m.peerAddrs[remoteID]
 	t := m.transport