diff --git a/enrollments-events/app/enrollment.py b/enrollments-events/app/enrollment.py
index 2b1a252..07b90f0 100644
--- a/enrollments-events/app/enrollment.py
+++ b/enrollments-events/app/enrollment.py
@@ -79,17 +79,6 @@ def enroll(
             entity_sk = f'LINKED_ENTITIES#{parent_entity.type}'
             keyprefix = parent_entity.type.lower()
 
-            # Child knows the parent
-            transact.put(
-                item={
-                    'id': enrollment.id,
-                    'sk': f'{entity_sk}#PARENT',
-                    'created_at': now_,
-                    f'{keyprefix}_id': perent_id,
-                },
-                cond_expr='attribute_not_exists(sk)',
-            )
-
             # Parent knows the child
             transact.put(
                 item={
@@ -101,6 +90,17 @@ def enroll(
                 cond_expr='attribute_not_exists(sk)',
             )
 
+            # Child knows the parent
+            transact.put(
+                item={
+                    'id': enrollment.id,
+                    'sk': f'{entity_sk}#PARENT',
+                    'created_at': now_,
+                    f'{keyprefix}_id': perent_id,
+                },
+                cond_expr='attribute_not_exists(sk)',
+            )
+
         if org:
             transact.put(
                 item={
diff --git a/enrollments-events/app/events/issue_cert.py b/enrollments-events/app/events/issue_cert.py
index 5ed43ae..0794a54 100644
--- a/enrollments-events/app/events/issue_cert.py
+++ b/enrollments-events/app/events/issue_cert.py
@@ -43,7 +43,7 @@ def lambda_handler(event: EventBridgeEvent, context: LambdaContext) -> bool:
     # Certificate may have no expiration
     cert_expires_at = (
         completed_at + timedelta(days=int(cert['exp_interval']))
-        if 'exp_interval' in cert
+        if cert.get('exp_interval', 0) > 0
         else None
     )
 
diff --git a/enrollments-events/tests/events/test_reenroll_if_failed.py b/enrollments-events/tests/events/test_reenroll_if_failed.py
index 3d60a6c..c216ea7 100644
--- a/enrollments-events/tests/events/test_reenroll_if_failed.py
+++ b/enrollments-events/tests/events/test_reenroll_if_failed.py
@@ -8,10 +8,11 @@ def test_reenroll(
     dynamodb_persistence_layer: DynamoDBPersistenceLayer,
     lambda_context: LambdaContext,
 ):
+    parent_id = '294e9864-8284-4287-b153-927b15d90900'
     event = {
         'detail': {
             'new_image': {
-                'id': '294e9864-8284-4287-b153-927b15d90900',
+                'id': parent_id,
                 'sk': '0',
                 'user': {
                     'id': '2beb8642-aab4-4088-86d4-2966fac7c570',
@@ -28,21 +29,20 @@ def test_reenroll(
     }
     assert app.lambda_handler(event, lambda_context)  # type: ignore
 
-    parent_entity = dynamodb_persistence_layer.collection.get_item(
-        KeyPair(
-            pk='294e9864-8284-4287-b153-927b15d90900',
-            sk='LINKED_ENTITIES#ENROLLMENT',
-        )
-    )
     # Parent knows the child
-    assert parent_entity['kind'] == 'CHILD'
-
     child_entity = dynamodb_persistence_layer.collection.get_item(
         KeyPair(
-            pk=parent_entity['enrollment_id'],
-            sk='LINKED_ENTITIES#ENROLLMENT',
+            pk=parent_id,
+            sk='LINKED_ENTITIES#ENROLLMENT#CHILD',
         )
     )
+    assert child_entity
+
     # Child knows the parent
-    assert child_entity['enrollment_id'] == parent_entity['id']
-    assert child_entity['kind'] == 'PARENT'
+    parent_entity = dynamodb_persistence_layer.collection.get_item(
+        KeyPair(
+            pk=child_entity['enrollment_id'],
+            sk='LINKED_ENTITIES#ENROLLMENT#PARENT',
+        )
+    )
+    assert parent_entity['enrollment_id'] == parent_id
diff --git a/enrollments-events/uv.lock b/enrollments-events/uv.lock
index e861e27..963300c 100644
--- a/enrollments-events/uv.lock
+++ b/enrollments-events/uv.lock
@@ -463,6 +463,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/31/b4/b9b800c45527aadd64d5b442f9b932b00648617eb5d63d2c7a6587b7cafc/jmespath-1.0.1-py3-none-any.whl", hash = "sha256:02e2e4cc71b5bcab88332eebf907519190dd9e6e82107fa7f83b1003a6252980", size = 20256, upload-time = "2022-06-17T18:00:10.251Z" },
 ]
 
+[[package]]
+name = "joserfc"
+version = "1.3.4"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cryptography" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/b0/79/d63a882c0212e95f3ba8863a115e5ca9a5d39413b02273ddce72058e717f/joserfc-1.3.4.tar.gz", hash = "sha256:67d8413c501c239f65eefad5ae685cfbfc401aa63289fc409ef7cc331b007227", size = 197787, upload-time = "2025-09-21T15:49:34.7Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/9a/78/beb171f0caac81f51695f43c87c0c20b3ce2a190cf74a3fbb0b9afe03b45/joserfc-1.3.4-py3-none-any.whl", hash = "sha256:30c845c58d441cfe32d08ac35e437812481ca8155373873b7abf80224bf601c0", size = 75638, upload-time = "2025-09-21T15:49:33.14Z" },
+]
+
 [[package]]
 name = "jsonlines"
 version = "4.0.0"
@@ -498,6 +510,7 @@ dependencies = [
     { name = "dictdiffer" },
     { name = "ftfy" },
     { name = "glom" },
+    { name = "joserfc" },
     { name = "meilisearch" },
     { name = "orjson" },
     { name = "passlib" },
@@ -505,7 +518,6 @@ dependencies = [
     { name = "pycpfcnpj" },
     { name = "pydantic", extra = ["email"] },
     { name = "pydantic-extra-types" },
-    { name = "pyjwt" },
     { name = "pytz" },
     { name = "requests" },
     { name = "smart-open", extra = ["s3"] },
@@ -521,6 +533,7 @@ requires-dist = [
     { name = "dictdiffer", specifier = ">=0.9.0" },
     { name = "ftfy", specifier = ">=6.3.1" },
     { name = "glom", specifier = ">=24.11.0" },
+    { name = "joserfc", specifier = ">=1.2.2" },
     { name = "meilisearch", specifier = ">=0.34.0" },
     { name = "orjson", specifier = ">=3.10.15" },
     { name = "passlib", specifier = ">=1.7.4" },
@@ -528,7 +541,6 @@ requires-dist = [
     { name = "pycpfcnpj", specifier = ">=1.8" },
     { name = "pydantic", extras = ["email"], specifier = ">=2.10.6" },
     { name = "pydantic-extra-types", specifier = ">=2.10.3" },
-    { name = "pyjwt", specifier = ">=2.10.1" },
     { name = "pytz", specifier = ">=2025.1" },
     { name = "requests", specifier = ">=2.32.3" },
     { name = "smart-open", extras = ["s3"], specifier = ">=7.1.0" },
@@ -774,15 +786,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/b6/5f/d6d641b490fd3ec2c4c13b4244d68deea3a1b970a97be64f34fb5504ff72/pydantic_settings-2.9.1-py3-none-any.whl", hash = "sha256:59b4f431b1defb26fe620c71a7d3968a710d719f5f4cdbbdb7926edeb770f6ef", size = 44356, upload-time = "2025-04-18T16:44:46.617Z" },
 ]
 
-[[package]]
-name = "pyjwt"
-version = "2.10.1"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/e7/46/bd74733ff231675599650d3e47f361794b22ef3e3770998dda30d3b63726/pyjwt-2.10.1.tar.gz", hash = "sha256:3cc5772eb20009233caf06e9d8a0577824723b44e6648ee0a2aedb6cf9381953", size = 87785, upload-time = "2024-11-28T03:43:29.933Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/61/ad/689f02752eeec26aed679477e80e632ef1b682313be70793d798c1d5fc8f/PyJWT-2.10.1-py3-none-any.whl", hash = "sha256:dcdd193e30abefd5debf142f9adfcdd2b58004e644f25406ffaebd50bd98dacb", size = 22997, upload-time = "2024-11-28T03:43:27.893Z" },
-]
-
 [[package]]
 name = "pytest"
 version = "8.3.5"