@@ -145,6 +145,48 @@ pub fn internal_issuer(app_id_hex: &str) -> String {
     format!("dstack:guest-api:{app_id_hex}")
 }
 
+/// A token whose shape and claims have been read, with the signature still
+/// unchecked.
+///
+/// Split out from verification so a caller can refuse a malformed token before
+/// it does anything expensive. The guest agent needs exactly that: checking a
+/// token it was handed must not cost a boot attestation.
+#[derive(Clone, Debug)]
+pub struct Decoded {
+    signing_input: String,
+    signature: Vec<u8>,
+    pub claims: Claims,
+}
+
+/// Read a token's header and claims without verifying it.
+///
+/// Everything here is cheap and local. The result says nothing about whether
+/// the token was signed by anyone; [`Verifier::verify_decoded`] answers that.
+pub fn decode(token: &str) -> Result<Decoded> {
+    let mut parts = token.split('.');
+    let (Some(header), Some(encoded_payload), Some(encoded_signature), None) =
+        (parts.next(), parts.next(), parts.next(), parts.next())
+    else {
+        bail!("token is not a JWT");
+    };
+    if header != HEADER {
+        // Covers `alg: none`, HMAC, and any header carrying key material.
+        bail!("unsupported JWT header");
+    }
+    let payload = URL_SAFE_NO_PAD
+        .decode(encoded_payload)
+        .context("payload is not base64url")?;
+    let claims = serde_json::from_slice(&payload).context("malformed claims")?;
+    let signature = URL_SAFE_NO_PAD
+        .decode(encoded_signature)
+        .context("signature is not base64url")?;
+    Ok(Decoded {
+        signing_input: format!("{header}.{encoded_payload}"),
+        signature,
+        claims,
+    })
+}
+
 /// Mint a token. `signing_key` is the raw 32-byte Ed25519 seed.
 pub fn sign(signing_key: &[u8; 32], claims: &Claims) -> Result<String> {
     let payload = serde_json::to_vec(claims).context("failed to serialize claims")?;
@@ -184,20 +226,37 @@ impl Verifier {
     /// `now` is seconds since the UNIX epoch, passed in rather than read here
     /// so the expiry rules can be tested.
     pub fn verify(&self, token: &str, app_id_hex: &str, now: u64) -> Result<ScopeSet> {
-        let mut parts = token.split('.');
-        let (Some(header), Some(encoded_payload), Some(signature), None) =
-            (parts.next(), parts.next(), parts.next(), parts.next())
-        else {
-            bail!("token is not a JWT");
-        };
-        if header != HEADER {
-            // Covers `alg: none`, HMAC, and any header carrying key material.
-            bail!("unsupported JWT header");
+        self.verify_decoded(&decode(token)?, app_id_hex, now)
+    }
+
+    /// Check the signature and claims of a token [`decode`] already read.
+    ///
+    /// Separate from [`Verifier::verify`] so a caller can pay for [`decode`]
+    /// alone -- it needs no key material and no app id -- and refuse the token
+    /// before doing anything that costs.
+    ///
+    /// The signature is checked before the claims: a claim error from an
+    /// unsigned token is a guess about a caller's intent, not a fact.
+    pub fn verify_decoded(&self, token: &Decoded, app_id_hex: &str, now: u64) -> Result<ScopeSet> {
+        let Decoded {
+            signing_input,
+            signature,
+            claims,
+        } = token;
+        let signature =
+            Signature::from_slice(signature).context("signature has the wrong length")?;
+
+        let keys = self.keys_for(&claims.iss, app_id_hex);
+        if keys.is_empty() {
+            bail!("unknown token issuer");
+        }
+        if !keys.iter().any(|key| {
+            key.verify_strict(signing_input.as_bytes(), &signature)
+                .is_ok()
+        }) {
+            bail!("token signature does not verify");
         }
-        let payload = URL_SAFE_NO_PAD
-            .decode(encoded_payload)
-            .context("payload is not base64url")?;
-        let claims: Claims = serde_json::from_slice(&payload).context("malformed claims")?;
+
         if claims.aud != app_id_hex {
             bail!("token was issued for a different application");
         }
@@ -210,23 +269,6 @@ impl Verifier {
         if claims.iat > now + CLOCK_LEEWAY_SECS {
             bail!("token was issued in the future");
         }
-        let signature = URL_SAFE_NO_PAD
-            .decode(signature)
-            .context("signature is not base64url")?;
-        let signature =
-            Signature::from_slice(&signature).context("signature has the wrong length")?;
-        let signing_input = format!("{header}.{encoded_payload}");
-
-        let keys = self.keys_for(&claims.iss, app_id_hex);
-        if keys.is_empty() {
-            bail!("unknown token issuer");
-        }
-        if !keys.iter().any(|key| {
-            key.verify_strict(signing_input.as_bytes(), &signature)
-                .is_ok()
-        }) {
-            bail!("token signature does not verify");
-        }
         Ok(claims.scopes())
     }
 
@@ -353,6 +395,29 @@ mod tests {
         assert!(verifier(1).verify(&future, APP_ID, 1000).is_err());
     }
 
+    #[test]
+    fn decoding_refuses_a_shape_no_token_could_have() {
+        for token in [
+            "not-a-token",
+            "a.b.c.d",
+            "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJpc3MiOiJ4In0.",
+            "eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.!!!.c2ln",
+        ] {
+            assert!(decode(token).is_err(), "{token}");
+        }
+        // A well-formed token decodes without any key: that is what lets the
+        // caller refuse it before doing work.
+        let token = mint(
+            1,
+            &internal_issuer(APP_ID),
+            APP_ID,
+            1000,
+            1300,
+            "guest:info",
+        );
+        assert_eq!(decode(&token).unwrap().claims.aud, APP_ID);
+    }
+
     #[test]
     fn accepts_an_external_issuer_by_name() {
         let verifier = Verifier::new(
 
@@ -2757,6 +2757,33 @@ fn gateway_nodes(kv_store: &KvStore, exclude_down: bool) -> Vec<GatewayNodeInfo>
         .collect()
 }
 
+/// Longest `agent_token` a registration may carry.
+///
+/// The token is a short Ed25519 JWT -- a few hundred bytes. The field is
+/// self-declared, persisted, synced to every peer and sent back out as a
+/// request header, so it is bounded here rather than trusted.
+const MAX_AGENT_TOKEN_BYTES: usize = 4096;
+
+/// The `agent_token` a registration may store, or `None`.
+///
+/// Absent and empty both mean "this CVM has no token", which is what a CVM
+/// that predates the field or could not mint one reports. A value past
+/// [`MAX_AGENT_TOKEN_BYTES`] is not a token at all: it is dropped with a
+/// warning rather than stored, so one CVM cannot inflate every record.
+fn validated_agent_token(instance_id: &str, token: Option<String>) -> Option<String> {
+    match token {
+        Some(token) if token.len() > MAX_AGENT_TOKEN_BYTES => {
+            warn!(
+                "[{instance_id}] ignoring an agent token of {} bytes (limit {MAX_AGENT_TOKEN_BYTES})",
+                token.len()
+            );
+            None
+        }
+        Some(token) if token.is_empty() => None,
+        token => token,
+    }
+}
+
 pub struct RpcHandler {
     remote_app_id: Option<Vec<u8>>,
     remote_app_info: Option<AppInfo>,
@@ -2817,6 +2844,7 @@ impl GatewayRpc for RpcHandler {
                 })
             })
             .transpose()?;
+        let agent_token = validated_agent_token(&instance_id, request.agent_token);
         self.state
             .register_cvm_async(
                 app_id,
@@ -2827,7 +2855,7 @@ impl GatewayRpc for RpcHandler {
                     port_policy,
                     // A real CVM always states its intent, either way.
                     health_check: Some(request.health_check),
-                    agent_token: request.agent_token.filter(|token| !token.is_empty()),
+                    agent_token,
                 },
             )
             .await
 
@@ -6,7 +6,7 @@
 //!
 //! Every request that reaches `[external]` names a scope, and the caller has
 //! to be granted it: either by an Ed25519 JWT, or -- when the host configured
-//! it -- by being anonymous. Nothing is granted by default.
+//! it -- by being anonymous. Nothing is granted without one or the other.
 //!
 //! This is deliberately not a trust boundary. The measured `public_*` switches
 //! in app-compose still decide whether confidential data (logs, sysinfo, TCB
@@ -17,7 +17,7 @@
 use std::time::{SystemTime, UNIX_EPOCH};
 
 use anyhow::{Context, Result};
-use dstack_api_auth::jwt::{self, IssuerKeys, ScopeSet, Verifier};
+use dstack_api_auth::jwt::{self, Decoded, IssuerKeys, ScopeSet, Verifier};
 use dstack_types::GuestAgentApiConfig;
 use ed25519_dalek::VerifyingKey;
 use rocket::{
@@ -94,7 +94,7 @@ impl GuestApiAuth {
     /// authenticate and got it wrong should see a refusal, not whatever the
     /// host happened to leave open. `app_id` is `None` while the app identity
     /// is unavailable, in which case no token can be checked.
-    fn resolve(&self, token: Option<&str>, app_id: Option<&str>) -> Result<ScopeSet> {
+    fn resolve(&self, token: Option<&Decoded>, app_id: Option<&str>) -> Result<ScopeSet> {
         let Some(token) = token else {
             return Ok(self.anonymous.clone());
         };
@@ -105,7 +105,7 @@ impl GuestApiAuth {
             .unwrap_or(0);
         let granted = self
             .verifier
-            .verify(token, app_id, now)
+            .verify_decoded(token, app_id, now)
             .context("rejected bearer token")?;
         Ok(self.anonymous.union(&granted))
     }
@@ -139,7 +139,11 @@ impl<'r> FromRequest<'r> for EffectiveScopes {
     async fn from_request(request: &'r Request<'_>) -> Outcome<Self, ()> {
         match request.local_cache(|| None::<ScopeSet>) {
             Some(scopes) => Outcome::Success(EffectiveScopes(scopes.clone())),
-            None => Outcome::Forward(rocket::http::Status::Forbidden),
+            // Unreachable: `ScopeFairing` either publishes a set or rewrites
+            // the request to the 401 route. Kept as a 401 rather than a 403 so
+            // a request that somehow got past the fairing still looks like
+            // every other refusal.
+            None => Outcome::Error((rocket::http::Status::Unauthorized, ())),
         }
     }
 }
@@ -206,7 +210,17 @@ impl Fairing for ScopeFairing {
     }
 
     async fn on_request(&self, req: &mut Request<'_>, _: &mut Data<'_>) {
-        let token = bearer_token(req);
+        // Read the token's shape first. It is the only cheap step, and it is
+        // the one an unauthenticated caller can drive; the app id lookup below
+        // can cost a boot attestation, so nothing that arrives here gets that
+        // far unless it is at least a well-formed Ed25519 token.
+        let token = match bearer_token(req).map(jwt::decode).transpose() {
+            Ok(token) => token,
+            Err(err) => {
+                tracing::debug!("{err:#}");
+                return deny(req);
+            }
+        };
         // Only a token needs the app id. Going through `identity()` rather
         // than a value bound at startup is what lets a boot whose first decode
         // failed recover: the retry is driven by the callers that need it.
@@ -219,10 +233,16 @@ impl Fairing for ScopeFairing {
                 .map(|identity| hex::encode(&identity.app_id)),
             None => None,
         };
-        let scopes = match self.state.api_auth().resolve(token, app_id.as_deref()) {
+        let scopes = match self
+            .state
+            .api_auth()
+            .resolve(token.as_ref(), app_id.as_deref())
+        {
             Ok(scopes) => scopes,
             Err(err) => {
-                warn!("{err:#}");
+                // Every caller on the internet reaches this. A warning per
+                // attempt is a log the public gets to size.
+                tracing::debug!("{err:#}");
                 return deny(req);
             }
         };
@@ -301,6 +321,13 @@ mod tests {
         .unwrap()
     }
 
+    /// Stands in for a token that is well-formed but not signed by anything
+    /// this agent trusts.
+    fn decoded(claims: jwt::Claims) -> Decoded {
+        let token = jwt::sign(&[1u8; 32], &claims).unwrap();
+        jwt::decode(&token).unwrap()
+    }
+
     #[test]
     fn anonymous_grants_only_what_was_configured() {
         assert!(auth(&[]).resolve(None, None).unwrap().is_empty());
@@ -311,8 +338,16 @@ mod tests {
 
     #[test]
     fn a_bad_token_is_refused_rather_than_downgraded_to_anonymous() {
+        let claims = jwt::Claims {
+            iss: jwt::internal_issuer("00"),
+            aud: "00".into(),
+            iat: 0,
+            exp: u64::MAX / 2,
+            scope: jwt::scope::DASHBOARD.into(),
+        };
+        // Signed by the wrong key, so it decodes and fails to verify.
         assert!(auth(&["guest:dashboard"])
-            .resolve(Some("not-a-token"), Some("00"))
+            .resolve(Some(&decoded(claims)), Some("00"))
             .is_err());
     }
 
 
@@ -51,8 +51,11 @@ async fn index(
     let show_logs = public_logs && scopes.allows(jwt::scope::LOGS);
     let show_tcb = public_tcbinfo && show_identity;
     let context = CallContext::builder().state(&**state).build();
-    let handler = ExternalRpcHandler::construct(context.clone())
-        .map_err(|e| format!("Failed to construct RPC handler: {}", e))?;
+    // `Info` costs a boot attestation (and may start a demo-cert request), so
+    // it is only asked for when the identity block -- and with it the TCB
+    // block, which requires `guest:info` too -- will be rendered.
+    // `guest:dashboard` is the one scope an anonymous visitor is most likely
+    // to be given, and on its own it renders every block hidden.
     let AppInfo {
         app_name,
         app_id,
@@ -67,10 +70,16 @@ async fn index(
         vm_config: _,
         cloud_vendor,
         cloud_product,
-    } = handler
-        .info()
-        .await
-        .map_err(|e| format!("Failed to get worker info: {}", e))?;
+    } = if show_identity || show_tcb {
+        let handler = ExternalRpcHandler::construct(context.clone())
+            .map_err(|e| format!("Failed to construct RPC handler: {}", e))?;
+        handler
+            .info()
+            .await
+            .map_err(|e| format!("Failed to get worker info: {}", e))?
+    } else {
+        Default::default()
+    };
 
     // Only collected when the page will actually render it. Collecting
     // otherwise would scan every process and disk, and spawn a GPU collector,