diff --git a/.changeset/readme-unwrap-oidc-federation-result.md b/.changeset/readme-unwrap-oidc-federation-result.md
new file mode 100644
index 000000000..d8eccf2d0
--- /dev/null
+++ b/.changeset/readme-unwrap-oidc-federation-result.md
@@ -0,0 +1,6 @@
+---
+"@cipherstash/stack": patch
+---
+
+Fix the README's OIDC federation example, which passed the `Result` from `OidcFederationStrategy.create()` straight to `config.authStrategy` and failed in `Encryption()` with `opts.strategy.getToken is missing`.
+It now unwraps the `Result` and passes `strategy.data`, and so does the `LockContext` JSDoc example.
diff --git a/README.md b/README.md
index d92a7502a..973fd6086 100644
--- a/README.md
+++ b/README.md
@@ -121,10 +121,14 @@ const client = await Encryption({ schemas: [users] });
 // strategy serves every user. (On this native entry the client calls getJwt
 // from a background task, so a request read from AsyncLocalStorage is not
 // visible there yet — pass it in, or build the client per request; see
-// cipherstash/stack#1065.)
+// cipherstash/stack#1065.) create() returns a Result: unwrap it and pass the
+// strategy itself, not the Result envelope.
+const strategy = OidcFederationStrategy.create(workspaceCrn, () => getUserJwt(req));
+if (strategy.failure) throw new Error(strategy.failure.error.message);
+
 const client = await Encryption({
   schemas: [users],
-  config: { authStrategy: OidcFederationStrategy.create(workspaceCrn, () => getUserJwt(req)) },
+  config: { authStrategy: strategy.data },
 });
 ```
 
diff --git a/languages/typescript/packages/stack/README.md b/languages/typescript/packages/stack/README.md
index d92a7502a..973fd6086 100644
--- a/languages/typescript/packages/stack/README.md
+++ b/languages/typescript/packages/stack/README.md
@@ -121,10 +121,14 @@ const client = await Encryption({ schemas: [users] });
 // strategy serves every user. (On this native entry the client calls getJwt
 // from a background task, so a request read from AsyncLocalStorage is not
 // visible there yet — pass it in, or build the client per request; see
-// cipherstash/stack#1065.)
+// cipherstash/stack#1065.) create() returns a Result: unwrap it and pass the
+// strategy itself, not the Result envelope.
+const strategy = OidcFederationStrategy.create(workspaceCrn, () => getUserJwt(req));
+if (strategy.failure) throw new Error(strategy.failure.error.message);
+
 const client = await Encryption({
   schemas: [users],
-  config: { authStrategy: OidcFederationStrategy.create(workspaceCrn, () => getUserJwt(req)) },
+  config: { authStrategy: strategy.data },
 });
 ```
 
diff --git a/languages/typescript/packages/stack/src/identity/index.ts b/languages/typescript/packages/stack/src/identity/index.ts
index 0db1debe7..20e9ef0cf 100644
--- a/languages/typescript/packages/stack/src/identity/index.ts
+++ b/languages/typescript/packages/stack/src/identity/index.ts
@@ -186,10 +186,14 @@ export function resolveLockContext(input: LockContextInput): Context {
  * import { OidcFederationStrategy } from "@cipherstash/auth"
  *
  * // Authenticate the client as the end user (replaces the old identify() flow).
+ * // `create()` returns a `Result` — unwrap it before passing the strategy.
+ * const strategy = OidcFederationStrategy.create(workspaceCrn, () => getJwt())
+ * if (strategy.failure) throw new Error(strategy.failure.error.message)
+ *
  * const client = await Encryption({
  *   schemas,
  *   config: {
- *     authStrategy: OidcFederationStrategy.create(workspaceCrn, () => getJwt()),
+ *     authStrategy: strategy.data,
  *   },
  * })
  *