diff --git a/CHANGELOG.md b/CHANGELOG.md
index 41c5b32..1b166e5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,23 +15,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- Strengthened tests guided by mutation testing; mutation score raised to
+  93% with a CI threshold of 90 (`minCoveredMsi` in `infection.json5`)
 - Test fixtures and README examples use RFC 2606 reserved domains
   (`provider.example.org` for IdP-side URLs, `app.example.org` for
   application-side URLs) instead of invented registrable domains
 
-- Strengthened constructor tests guided by mutation testing: the `jwt`
-  collaborator is asserted to become the request factory, and `0` is
-  asserted to be an accepted boundary value for `cacheDuration` and
-  `leeway`
-- Strengthened cache assertions guided by mutation testing: the discovery
-  document and JWKS key map are asserted to be written to the cache with
-  the configured duration under the namespaced key, and a multi-key JWKS
-  is asserted to reach `JWT::decode` in full
-- Strengthened exception assertions guided by mutation testing: thrown
-  messages are asserted in full (including dynamic parts), wrap-boundary
-  exceptions assert code `0` and the chained `$previous` cause, and
-  invalid JSON from the token endpoint is covered
-
 ## [5.0.0] - 2026-06-02
 
 Reworked exception hierarchy and tightened IdP-payload validations. The runtime
diff --git a/infection.json5 b/infection.json5
index 6ef2f4f..9d11f19 100644
--- a/infection.json5
+++ b/infection.json5
@@ -5,8 +5,11 @@
     },
     "threads": "max",
     // Minimum mutation score for covered code; enforced locally and in CI.
-    // Baseline measured at 71% — ratchet up as surviving mutants are killed.
-    "minCoveredMsi": 68,
+    // The suite scores 93%; the 13 surviving mutants are equivalent or
+    // contrived (JSON depth literals, RNG default lengths, casts only
+    // observable on corrupted cache). 90 defends the score with headroom
+    // for run-to-run variance.
+    "minCoveredMsi": 90,
     "logs": {
         "text": "infection.log",
         "html": "infection.html",