diff --git a/crates/buzz-auth/src/nip42.rs b/crates/buzz-auth/src/nip42.rs
index 8ee7c90890..1450f65a0b 100644
--- a/crates/buzz-auth/src/nip42.rs
+++ b/crates/buzz-auth/src/nip42.rs
@@ -53,8 +53,6 @@ pub fn verify_nip42_event(
         return Err(AuthError::InvalidSignature);
     }
 
-    buzz_core::verify_event(event).map_err(|_| AuthError::InvalidSignature)?;
-
     let challenge = event
         .tags
         .find(TagKind::Challenge)
@@ -65,6 +63,10 @@ pub fn verify_nip42_event(
         return Err(AuthError::ChallengeMismatch);
     }
 
+    // Reject proofs for another connection before hashing and Schnorr verification.
+    // Matching a challenge never replaces cryptographic verification.
+    buzz_core::verify_event(event).map_err(|_| AuthError::InvalidSignature)?;
+
     let relay = event
         .tags
         .find(TagKind::Relay)