Did you move off of Node.js v20.x yet? There are only a couple weeks util its EOL. Save yourself the headache of scrambling to upgrade next year and jump straight to v24.x LTS
Introducing CWS, CSS Web Signatures. A security token scheme that runs entirely in the browser's style engine. No JavaScript. No WebAssembly. No server-side computation.
Spec + interactive demo: panva.github.io/CS24
When it comes to JWTs issued for "yourself" the JWE format is far superior to JWS. Just let go of the HMAC JWS algorithms and use JWE direct encryption instead.
You get confidentiality and it forces use of correct-length keys.
await new jose.EncryptJWT > await new jose.SignJWT