diff --git a/src/ageAssurance/debug.ts b/src/ageAssurance/debug.ts
index 55023c5ba6..d1b9997fa2 100644
--- a/src/ageAssurance/debug.ts
+++ b/src/ageAssurance/debug.ts
@@ -12,7 +12,8 @@ import {type Geolocation} from '#/geolocation'
 /**
  * Debug-only config shape. Mirrors {@link AppBskyAgeassuranceDefs.Config} but
  * uses {@link AgeAssuranceConfigRegion}, which carries the not-yet-in-lexicon
- * `verificationMethods` field so we can prototype on-device verification.
+ * `additionalVerificationMethods` field so we can prototype on-device
+ * verification.
  */
 export type DebugConfig = {
   regions: AgeAssuranceConfigRegion[]
@@ -76,7 +77,7 @@ export const config: DebugConfig = {
       countryCode: 'US',
       regionCode: 'TX',
       minAccessAge: 18,
-      verificationMethods: ['device', 'kws'],
+      additionalVerificationMethods: ['device'],
       rules: [
         {
           age: 18,
diff --git a/src/ageAssurance/types.ts b/src/ageAssurance/types.ts
index 9d841f67df..adf536b66b 100644
--- a/src/ageAssurance/types.ts
+++ b/src/ageAssurance/types.ts
@@ -7,25 +7,28 @@ import {
 import {logger} from '#/ageAssurance/logger'
 
 /**
- * The ways a user can satisfy age assurance within a given region.
+ * Verification methods permitted in a region *in addition to* the third-party
+ * (KWS) flow, which is always supported. We deliberately don't model `kws` here
+ * so a region can never be configured as device-only (which would lock out web
+ * and any platform without the native age API).
  *
- * - `kws`: the third-party (KWS) verification flow.
  * - `device`: native on-device age APIs (Apple Declared Age Range / Google
  *   Play Age Signals), surfaced via `expo-age-range`.
  *
  * NOTE: this is not yet part of the `app.bsky.ageassurance` lexicon. It's
  * modeled client-side (see {@link AgeAssuranceConfigRegion}) while we prototype
- * the shape. Once the lexicon adds `verificationMethods`, this can be removed in
- * favor of the generated type.
+ * the shape. Once the lexicon adds `additionalVerificationMethods`, this can be
+ * removed in favor of the generated type.
  */
-export type AgeAssuranceVerificationMethod = 'device' | 'kws'
+export type AgeAssuranceVerificationMethod = 'device'
 
 /**
- * A region config extended with the (not-yet-in-lexicon) `verificationMethods`
- * field. Regions without the field are treated as KWS-only.
+ * A region config extended with the (not-yet-in-lexicon)
+ * `additionalVerificationMethods` field. Regions without the field support only
+ * the always-available KWS flow.
  */
 export type AgeAssuranceConfigRegion = AppBskyAgeassuranceDefs.ConfigRegion & {
-  verificationMethods?: AgeAssuranceVerificationMethod[]
+  additionalVerificationMethods?: AgeAssuranceVerificationMethod[]
 }
 
 /**
diff --git a/src/ageAssurance/util.ts b/src/ageAssurance/util.ts
index 6128e4a620..dc80dd88eb 100644
--- a/src/ageAssurance/util.ts
+++ b/src/ageAssurance/util.ts
@@ -40,17 +40,20 @@ export function getAgeAssuranceRegionConfigWithFallback(
 }
 
 /**
- * Returns the verification methods permitted for a region, defaulting to
- * `['kws']` when the region doesn't specify any (the historical behavior).
+ * Returns the verification methods permitted for a region *in addition to* the
+ * always-supported KWS flow. Empty when the region doesn't specify any (the
+ * historical KWS-only behavior).
  *
- * NOTE: `verificationMethods` is not yet part of the lexicon, so we read it via
- * {@link AgeAssuranceConfigRegion}. See that type for the migration note.
+ * NOTE: `additionalVerificationMethods` is not yet part of the lexicon, so we
+ * read it via {@link AgeAssuranceConfigRegion}. See that type for the migration
+ * note.
  */
-export function getRegionVerificationMethods(
+export function getRegionAdditionalVerificationMethods(
   region: AppBskyAgeassuranceDefs.ConfigRegion,
 ): AgeAssuranceVerificationMethod[] {
-  const methods = (region as AgeAssuranceConfigRegion).verificationMethods
-  return methods && methods.length > 0 ? methods : ['kws']
+  return (
+    (region as AgeAssuranceConfigRegion).additionalVerificationMethods ?? []
+  )
 }
 
 /**
@@ -60,7 +63,7 @@ export function getRegionVerificationMethods(
 export function regionAllowsDeviceVerification(
   region: AppBskyAgeassuranceDefs.ConfigRegion,
 ): boolean {
-  return getRegionVerificationMethods(region).includes('device')
+  return getRegionAdditionalVerificationMethods(region).includes('device')
 }
 
 /**