diff --git a/server/main.test.ts b/server/main.test.ts
index 1fdfbd3..4db7afa 100644
--- a/server/main.test.ts
+++ b/server/main.test.ts
@@ -385,11 +385,7 @@ Deno.test("WebAuthn - /api/login/challenge handles username for PRF", async () =
       if (query.includes("SELECT id FROM users WHERE username =")) {
         return Promise.resolve([{ id: "mock-user-id" }]);
       }
-      if (
-        query.includes(
-          "SELECT credential_id, prf_enabled, prf_salt FROM passkeys WHERE user_id =",
-        )
-      ) {
+      if (query.includes("FROM passkeys WHERE user_id =")) {
         return Promise.resolve([{
           credential_id: "mock-cred",
           prf_enabled: true,
diff --git a/server/main.ts b/server/main.ts
index 2110d08..bdd9cff 100644
--- a/server/main.ts
+++ b/server/main.ts
@@ -658,8 +658,8 @@ app.post("/api/login/challenge", async (c) => {
     body = {};
   }
   const username = body.username;
-
   let extensions: any = undefined;
+  let allowCredentials: any[] | undefined = undefined;
 
   if (username) {
     const user = await sqlWrapper
@@ -668,17 +668,28 @@ app.post("/api/login/challenge", async (c) => {
       );
     if (user) {
       const passkeys = await sqlWrapper
-        .sql`SELECT credential_id, prf_enabled, prf_salt FROM passkeys WHERE user_id = ${user.id} AND prf_enabled = true AND prf_salt IS NOT NULL`;
+        .sql`SELECT credential_id, transports, prf_enabled, prf_salt FROM passkeys WHERE user_id = ${user.id}`;
 
       if (passkeys.length > 0) {
-        extensions = {
-          ["prf" as string]: { evalByCredential: {} },
-        };
-        for (const pk of passkeys) {
-          const saltBytes = decodeBase64Url(pk.prf_salt);
-          extensions["prf"]["evalByCredential"][pk.credential_id] = {
-            first: saltBytes,
+        allowCredentials = passkeys.map((pk: any) => ({
+          id: pk.credential_id,
+          type: "public-key",
+          transports: pk.transports || undefined,
+        }));
+
+        const prfPasskeys = passkeys.filter((pk: any) =>
+          pk.prf_enabled && pk.prf_salt
+        );
+        if (prfPasskeys.length > 0) {
+          extensions = {
+            ["prf" as string]: { evalByCredential: {} },
           };
+          for (const pk of prfPasskeys) {
+            const saltBytes = decodeBase64Url(pk.prf_salt);
+            extensions["prf"]["evalByCredential"][pk.credential_id] = {
+              first: saltBytes,
+            };
+          }
         }
       }
     }
@@ -688,6 +699,7 @@ app.post("/api/login/challenge", async (c) => {
     rpID,
     userVerification: "preferred",
     timeout: 60000,
+    allowCredentials,
     extensions,
   });