diff --git a/auth_test.go b/auth_test.go
index f67a8e0f..4c6f5e64 100644
--- a/auth_test.go
+++ b/auth_test.go
@@ -8,7 +8,7 @@ import (
 	"crypto"
 	"testing"
 
-	"github.com/refraction-networking/utls/internal/fips140tls"
+	"github.com/kernel/utls/internal/fips140tls"
 )
 
 func TestSignatureSelection(t *testing.T) {
diff --git a/cipher_suites.go b/cipher_suites.go
index 5e01f7e8..d24f520a 100644
--- a/cipher_suites.go
+++ b/cipher_suites.go
@@ -18,7 +18,7 @@ import (
 	"runtime"
 	_ "unsafe" // for linkname
 
-	"github.com/refraction-networking/utls/internal/boring"
+	"github.com/kernel/utls/internal/boring"
 	"golang.org/x/sys/cpu"
 
 	"golang.org/x/crypto/chacha20poly1305"
diff --git a/common.go b/common.go
index 73b6dad5..307cbd8a 100644
--- a/common.go
+++ b/common.go
@@ -26,7 +26,7 @@ import (
 	"time"
 	_ "unsafe" // for linkname
 
-	"github.com/refraction-networking/utls/internal/fips140tls"
+	"github.com/kernel/utls/internal/fips140tls"
 )
 
 const (
diff --git a/ech.go b/ech.go
index 184c4682..1b601646 100644
--- a/ech.go
+++ b/ech.go
@@ -11,7 +11,7 @@ import (
 	"slices"
 	"strings"
 
-	"github.com/refraction-networking/utls/internal/hpke"
+	"github.com/kernel/utls/internal/hpke"
 
 	"golang.org/x/crypto/cryptobyte"
 )
diff --git a/examples/ech/main.go b/examples/ech/main.go
index f3072027..4187012b 100644
--- a/examples/ech/main.go
+++ b/examples/ech/main.go
@@ -15,7 +15,7 @@ import (
 	"os"
 	"time"
 
-	tls "github.com/refraction-networking/utls"
+	tls "github.com/kernel/utls"
 	"golang.org/x/net/http2"
 )
 
diff --git a/examples/old/examples.go b/examples/old/examples.go
index fc7ef2e7..55922850 100644
--- a/examples/old/examples.go
+++ b/examples/old/examples.go
@@ -10,7 +10,7 @@ import (
 	"net/url"
 	"time"
 
-	tls "github.com/refraction-networking/utls"
+	tls "github.com/kernel/utls"
 	"golang.org/x/net/http2"
 )
 
diff --git a/examples/tls-resumption/main.go b/examples/tls-resumption/main.go
index baaa213a..581cc4db 100644
--- a/examples/tls-resumption/main.go
+++ b/examples/tls-resumption/main.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"time"
 
-	tls "github.com/refraction-networking/utls"
+	tls "github.com/kernel/utls"
 )
 
 type ClientSessionCache struct {
diff --git a/go.mod b/go.mod
index 6cc2d356..c89585de 100644
--- a/go.mod
+++ b/go.mod
@@ -1,4 +1,4 @@
-module github.com/refraction-networking/utls
+module github.com/kernel/utls
 
 go 1.24
 
diff --git a/handshake_client.go b/handshake_client.go
index bba58a5a..4531019e 100644
--- a/handshake_client.go
+++ b/handshake_client.go
@@ -23,10 +23,10 @@ import (
 	"strings"
 	"time"
 
-	"github.com/refraction-networking/utls/internal/byteorder"
-	"github.com/refraction-networking/utls/internal/fips140tls"
-	"github.com/refraction-networking/utls/internal/hpke"
-	"github.com/refraction-networking/utls/internal/tls13"
+	"github.com/kernel/utls/internal/byteorder"
+	"github.com/kernel/utls/internal/fips140tls"
+	"github.com/kernel/utls/internal/hpke"
+	"github.com/kernel/utls/internal/tls13"
 )
 
 type clientHandshakeState struct {
diff --git a/handshake_client_test.go b/handshake_client_test.go
index 5cb8617e..f7f2a0b1 100644
--- a/handshake_client_test.go
+++ b/handshake_client_test.go
@@ -31,8 +31,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/refraction-networking/utls/internal/byteorder"
-	"github.com/refraction-networking/utls/internal/fips140tls"
+	"github.com/kernel/utls/internal/byteorder"
+	"github.com/kernel/utls/internal/fips140tls"
 )
 
 // Note: see comment in handshake_test.go for details of how the reference
diff --git a/handshake_client_tls13.go b/handshake_client_tls13.go
index 01c2756c..4d5f3221 100644
--- a/handshake_client_tls13.go
+++ b/handshake_client_tls13.go
@@ -19,8 +19,8 @@ import (
 	"slices"
 	"time"
 
-	"github.com/refraction-networking/utls/internal/hkdf"
-	"github.com/refraction-networking/utls/internal/tls13"
+	"github.com/kernel/utls/internal/hkdf"
+	"github.com/kernel/utls/internal/tls13"
 )
 
 type clientHandshakeStateTLS13 struct {
diff --git a/handshake_messages.go b/handshake_messages.go
index c382b334..883838b6 100644
--- a/handshake_messages.go
+++ b/handshake_messages.go
@@ -1499,6 +1499,7 @@ func (m *certificateMsg) unmarshal(data []byte) bool {
 }
 
 type certificateMsgTLS13 struct {
+	original     []byte // [uTLS]
 	certificate  Certificate
 	ocspStapling bool
 	scts         bool
@@ -1561,7 +1562,7 @@ func marshalCertificate(b *cryptobyte.Builder, certificate Certificate) {
 }
 
 func (m *certificateMsgTLS13) unmarshal(data []byte) bool {
-	*m = certificateMsgTLS13{}
+	*m = certificateMsgTLS13{original: data} // [uTLS]
 	s := cryptobyte.String(data)
 
 	var context cryptobyte.String
@@ -1578,6 +1579,22 @@ func (m *certificateMsgTLS13) unmarshal(data []byte) bool {
 	return true
 }
 
+// [UTLS SECTION BEGINS]
+// originalBytes lets transcriptMsg hash this Certificate message exactly as it
+// was received, instead of a re-marshal via marshalCertificate(). The re-marshal
+// is not guaranteed to be byte-identical to the peer's encoding (only leaf
+// OCSP/SCT are re-emitted, in a fixed order; other per-certificate extensions
+// and non-canonical length encodings are lost), which diverges the TLS 1.3
+// handshake transcript and causes CertificateVerify to fail with
+// "crypto/rsa: verification error". clientHelloMsg, serverHelloMsg and
+// certificateRequestMsgTLS13 already preserve their original bytes for the same
+// reason.
+func (m *certificateMsgTLS13) originalBytes() []byte {
+	return m.original
+}
+
+// [UTLS SECTION ENDS]
+
 func unmarshalCertificate(s *cryptobyte.String, certificate *Certificate) bool {
 	var certList cryptobyte.String
 	if !s.ReadUint24LengthPrefixed(&certList) {
diff --git a/handshake_messages_test.go b/handshake_messages_test.go
index b71d97ca..aa916c6b 100644
--- a/handshake_messages_test.go
+++ b/handshake_messages_test.go
@@ -100,6 +100,8 @@ func TestMarshalUnmarshal(t *testing.T) {
 					t.original = nil
 				case *certificateRequestMsgTLS13: // [UTLS]
 					t.original = nil // [UTLS]
+				case *certificateMsgTLS13: // [UTLS]
+					t.original = nil // [UTLS]
 				}
 
 				if !reflect.DeepEqual(m1, m) {
diff --git a/handshake_server.go b/handshake_server.go
index e38ebaeb..fb51901c 100644
--- a/handshake_server.go
+++ b/handshake_server.go
@@ -18,7 +18,7 @@ import (
 	"io"
 	"time"
 
-	"github.com/refraction-networking/utls/internal/byteorder"
+	"github.com/kernel/utls/internal/byteorder"
 )
 
 // serverHandshakeState contains details of a server handshake in progress.
diff --git a/handshake_server_test.go b/handshake_server_test.go
index 525ee13a..c674866c 100644
--- a/handshake_server_test.go
+++ b/handshake_server_test.go
@@ -27,7 +27,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/refraction-networking/utls/internal/fips140tls"
+	"github.com/kernel/utls/internal/fips140tls"
 )
 
 func testClientHello(t *testing.T, serverConfig *Config, m handshakeMessage) {
diff --git a/handshake_server_tls13.go b/handshake_server_tls13.go
index 510db6f6..29530175 100644
--- a/handshake_server_tls13.go
+++ b/handshake_server_tls13.go
@@ -18,11 +18,11 @@ import (
 	"sort"
 	"time"
 
-	"github.com/refraction-networking/utls/internal/byteorder"
-	"github.com/refraction-networking/utls/internal/fips140tls"
-	"github.com/refraction-networking/utls/internal/hkdf"
-	"github.com/refraction-networking/utls/internal/hpke"
-	"github.com/refraction-networking/utls/internal/tls13"
+	"github.com/kernel/utls/internal/byteorder"
+	"github.com/kernel/utls/internal/fips140tls"
+	"github.com/kernel/utls/internal/hkdf"
+	"github.com/kernel/utls/internal/hpke"
+	"github.com/kernel/utls/internal/tls13"
 )
 
 // maxClientPSKIdentities is the number of client PSK identities the server will
diff --git a/internal/hpke/hpke.go b/internal/hpke/hpke.go
index 68876610..ecd64004 100644
--- a/internal/hpke/hpke.go
+++ b/internal/hpke/hpke.go
@@ -13,8 +13,8 @@ import (
 	"errors"
 	"math/bits"
 
-	"github.com/refraction-networking/utls/internal/byteorder"
-	"github.com/refraction-networking/utls/internal/hkdf"
+	"github.com/kernel/utls/internal/byteorder"
+	"github.com/kernel/utls/internal/hkdf"
 	"golang.org/x/crypto/chacha20poly1305"
 )
 
diff --git a/internal/quicvarint/varint.go b/internal/quicvarint/varint.go
index e4a1063d..745567a3 100644
--- a/internal/quicvarint/varint.go
+++ b/internal/quicvarint/varint.go
@@ -9,7 +9,7 @@ import (
 	"fmt"
 	"io"
 
-	"github.com/refraction-networking/utls/internal/quicvarint/protocol"
+	"github.com/kernel/utls/internal/quicvarint/protocol"
 )
 
 // taken from the QUIC draft
diff --git a/internal/tls13/tls13.go b/internal/tls13/tls13.go
index 6bd5d4df..1bc2a44a 100644
--- a/internal/tls13/tls13.go
+++ b/internal/tls13/tls13.go
@@ -9,8 +9,8 @@ package tls13
 import (
 	fips140 "hash"
 
-	"github.com/refraction-networking/utls/internal/byteorder"
-	"github.com/refraction-networking/utls/internal/hkdf"
+	"github.com/kernel/utls/internal/byteorder"
+	"github.com/kernel/utls/internal/hkdf"
 )
 
 // We don't set the service indicator in this package but we delegate that to
diff --git a/key_schedule.go b/key_schedule.go
index 0afa04bd..80b5d3f5 100644
--- a/key_schedule.go
+++ b/key_schedule.go
@@ -12,7 +12,7 @@ import (
 	"hash"
 	"io"
 
-	"github.com/refraction-networking/utls/internal/tls13"
+	"github.com/kernel/utls/internal/tls13"
 )
 
 // This file contains the functions necessary to compute the TLS 1.3 key
diff --git a/key_schedule_test.go b/key_schedule_test.go
index 0c579448..2a394828 100644
--- a/key_schedule_test.go
+++ b/key_schedule_test.go
@@ -12,7 +12,7 @@ import (
 	"testing"
 	"unicode"
 
-	"github.com/refraction-networking/utls/internal/tls13"
+	"github.com/kernel/utls/internal/tls13"
 )
 
 func TestACVPVectors(t *testing.T) {
diff --git a/link_test.go b/link_test.go
index c034e936..90adec12 100644
--- a/link_test.go
+++ b/link_test.go
@@ -11,7 +11,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/refraction-networking/utls/testenv"
+	"github.com/kernel/utls/testenv"
 )
 
 // Tests that the linker is able to remove references to the Client or Server if unused.
diff --git a/prf.go b/prf.go
index 2c638ba8..780f1e06 100644
--- a/prf.go
+++ b/prf.go
@@ -15,7 +15,7 @@ import (
 	"fmt"
 	"hash"
 
-	"github.com/refraction-networking/utls/internal/tls12"
+	"github.com/kernel/utls/internal/tls12"
 )
 
 type prfFunc func(secret []byte, label string, seed []byte, keyLen int) []byte
diff --git a/testdata/Client-TLSv13-CertificateEntryUnknownExtension b/testdata/Client-TLSv13-CertificateEntryUnknownExtension
new file mode 100644
index 00000000..3e28a54f
--- /dev/null
+++ b/testdata/Client-TLSv13-CertificateEntryUnknownExtension
@@ -0,0 +1,92 @@
+>>> Flow 1 (client to server)
+00000000  16 03 01 00 e3 01 00 00  df 03 03 00 00 00 00 00  |................|
+00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000020  00 00 00 00 00 00 00 00  00 00 00 20 00 00 00 00  |........... ....|
+00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 06 13 03  |................|
+00000050  13 01 13 02 01 00 00 90  00 00 00 13 00 11 00 00  |................|
+00000060  0e 65 78 61 6d 70 6c 65  2e 67 6f 6c 61 6e 67 00  |.example.golang.|
+00000070  0b 00 02 01 00 ff 01 00  01 00 00 17 00 00 00 12  |................|
+00000080  00 00 00 05 00 05 01 00  00 00 00 00 0a 00 0a 00  |................|
+00000090  08 00 1d 00 17 00 18 00  19 00 0d 00 1a 00 18 08  |................|
+000000a0  04 04 03 08 07 08 05 08  06 04 01 05 01 06 01 05  |................|
+000000b0  03 06 03 02 01 02 03 00  2b 00 03 02 03 04 00 33  |........+......3|
+000000c0  00 26 00 24 00 1d 00 20  2f e5 7d a3 47 cd 62 43  |.&.$... /.}.G.bC|
+000000d0  15 28 da ac 5f bb 29 07  30 ff f6 84 af c4 cf c2  |.(.._.).0.......|
+000000e0  ed 90 99 5f 58 cb 3b 74                           |..._X.;t|
+>>> Flow 2 (server to client)
+00000000  16 03 03 00 7a 02 00 00  76 03 03 00 00 00 00 00  |....z...v.......|
+00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000020  00 00 00 00 00 00 00 00  00 00 00 20 00 00 00 00  |........... ....|
+00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000040  00 00 00 00 00 00 00 00  00 00 00 00 13 03 00 00  |................|
+00000050  2e 00 2b 00 02 03 04 00  33 00 24 00 1d 00 20 2f  |..+.....3.$... /|
+00000060  e5 7d a3 47 cd 62 43 15  28 da ac 5f bb 29 07 30  |.}.G.bC.(.._.).0|
+00000070  ff f6 84 af c4 cf c2 ed  90 99 5f 58 cb 3b 74 14  |.........._X.;t.|
+00000080  03 03 00 01 01 17 03 03  00 17 c3 5c 75 b6 bc 4f  |...........\u..O|
+00000090  a0 0b fa ed bc 13 9f c0  6c cf 00 40 55 db b6 6f  |........l..@U..o|
+000000a0  5b 17 03 03 02 94 84 ee  ac d7 21 dd d4 1c 04 3f  |[.........!....?|
+000000b0  54 89 43 9c ab e3 0a 6a  04 3c 0a ae 7b b8 58 23  |T.C....j.<..{.X#|
+000000c0  ff e1 53 51 81 b7 f1 b8  26 fc 6d 9e 25 d9 1c 52  |..SQ....&.m.%..R|
+000000d0  d4 65 62 67 f5 1b d0 dd  48 35 41 d3 7a 15 cd e1  |.ebg....H5A.z...|
+000000e0  25 e5 c8 da dd a7 d3 28  aa a1 ed 42 f2 cb 76 a3  |%......(...B..v.|
+000000f0  00 bf 22 0d 5b fd 85 6a  1a 81 c6 e4 a2 0e c8 19  |..".[..j........|
+00000100  fb 53 7d e5 8b 4d 8b 78  0d 3a 66 ff b8 bf a6 a8  |.S}..M.x.:f.....|
+00000110  ea f6 6d af 12 df 76 b4  d7 fa 29 5e dc d7 ee dd  |..m...v...)^....|
+00000120  9d 5e 23 2e c7 00 c0 8d  1f bb 50 35 0f 30 fe 70  |.^#.......P5.0.p|
+00000130  98 e0 48 7c 25 90 bd 84  09 19 31 a8 50 a4 98 74  |..H|%.....1.P..t|
+00000140  71 13 04 c7 93 b7 3c 12  ef 49 1d fa bf 33 da 93  |q.....<..I...3..|
+00000150  a8 e2 86 85 fd 2f 57 3a  82 b7 2d a9 ec 3b ee fc  |...../W:..-..;..|
+00000160  f5 4d a7 d3 e5 e7 bc 21  69 bb 17 0e eb 86 e4 a8  |.M.....!i.......|
+00000170  19 d4 ec a4 67 81 14 0d  1b 20 6d f2 db 9d b5 7a  |....g.... m....z|
+00000180  9a b2 0d 75 57 c8 8c f9  eb fa 33 c7 8e f4 ec 15  |...uW.....3.....|
+00000190  e1 de 0a c5 29 40 25 3c  8f 3b e6 4c 15 c1 f5 7d  |....)@%<.;.L...}|
+000001a0  89 80 d7 c7 6f 4e 25 7e  fb be 19 b2 6a 9c 4e 99  |....oN%~....j.N.|
+000001b0  87 e4 cc 0e be dc 3b 0a  7e 9b b3 6d 73 66 35 57  |......;.~..msf5W|
+000001c0  47 e9 e9 24 65 b6 1b de  ea 65 c9 b7 6e 48 23 9a  |G..$e....e..nH#.|
+000001d0  92 53 4e 39 c6 a7 d8 af  e9 f0 7a 5b 1c a1 3a b6  |.SN9......z[..:.|
+000001e0  6f ea 10 29 91 43 15 f3  c5 cc 57 2e 81 b2 80 dc  |o..).C....W.....|
+000001f0  d4 70 12 62 06 05 ea 29  3f 1e 6e 6f d9 69 54 99  |.p.b...)?.no.iT.|
+00000200  72 94 1c 39 09 60 e7 14  fb 67 0e 44 75 cc 17 f2  |r..9.`...g.Du...|
+00000210  94 07 40 58 e6 ea 22 d1  0a fb de 36 21 b8 dc a9  |..@X.."....6!...|
+00000220  3f a7 c2 0d 20 18 9d 93  1d fb 1d 03 b9 2b 5e 9e  |?... ........+^.|
+00000230  eb b9 0a 17 98 fe b0 01  da 29 da 97 4c d9 bb b3  |.........)..L...|
+00000240  7c 1d 44 19 bc 90 df ce  23 17 f7 a0 4f db 4b 5f  ||.D.....#...O.K_|
+00000250  b1 0f d1 5d b1 6c 4a 5e  e9 d9 dd 89 07 62 e8 e5  |...].lJ^.....b..|
+00000260  69 bb 7e ef db 79 2c 18  5f 42 fe d1 39 41 fa 77  |i.~..y,._B..9A.w|
+00000270  3b be 55 29 a4 ef 94 79  87 6b a6 bc 05 c0 c5 ae  |;.U)...y.k......|
+00000280  ac 16 36 ae 9e 0d 7a 19  b2 5c 1d e9 3d 3c 5e fe  |..6...z..\..=<^.|
+00000290  4b 2d 60 cb cf c4 1a 15  48 75 15 99 63 07 24 0c  |K-`.....Hu..c.$.|
+000002a0  8a 51 f0 59 b0 03 9c 71  a1 61 f6 79 74 75 16 51  |.Q.Y...q.a.ytu.Q|
+000002b0  bd 65 6e 58 1f 00 ed 07  c0 80 2d c3 9e 12 a7 b1  |.enX......-.....|
+000002c0  08 8f 1e c0 8a 98 d2 fa  dc 92 b2 f4 b6 d8 63 d9  |..............c.|
+000002d0  d4 aa e5 f4 9e e8 3e 49  fa 66 4f a1 5a 5c 46 b2  |......>I.fO.Z\F.|
+000002e0  2c 97 14 b7 19 cb ac 02  fa a4 c6 23 3e 4f 9b f2  |,..........#>O..|
+000002f0  83 34 0b 42 50 48 a8 36  b0 50 a2 39 41 2d 9f 11  |.4.BPH.6.P.9A-..|
+00000300  57 3c 99 88 9f 1f 07 d6  1a e4 8b 95 37 0f fd 8c  |W<..........7...|
+00000310  c8 f4 ee 71 ba 20 bb 9d  4a b4 a6 f2 9c ad 0a 6c  |...q. ..J......l|
+00000320  14 23 bb 93 8e 7b cb 20  13 a2 af 0d 83 f2 01 33  |.#...{. .......3|
+00000330  8f d3 25 5c 0f 74 00 a1  ee d9 17 03 03 00 99 dc  |..%\.t..........|
+00000340  f2 0b ec 67 a2 40 d2 8c  b6 f1 47 2b e5 cd 14 8a  |...g.@....G+....|
+00000350  df 0f b5 12 b5 56 90 4d  70 b8 46 05 46 8e a6 94  |.....V.Mp.F.F...|
+00000360  49 b7 6d 1f fe ab 8f d9  69 45 6e 5c 78 fd 05 ec  |I.m.....iEn\x...|
+00000370  6e 48 f3 48 78 f4 26 81  07 39 0b 8c 13 db 03 29  |nH.Hx.&..9.....)|
+00000380  c6 92 ba 44 da 0f b6 04  6a f5 fa a5 e8 57 97 a9  |...D....j....W..|
+00000390  de d7 51 4e 55 ee 90 8a  96 ee 68 62 15 bb 53 c2  |..QNU.....hb..S.|
+000003a0  8d 78 bc d5 d1 55 70 c4  09 09 ff 4b f5 4b 17 50  |.x...Up....K.K.P|
+000003b0  ed 46 88 db 92 9f c8 02  fc 32 dd b2 f0 7d ec 73  |.F.......2...}.s|
+000003c0  0c 74 d2 55 6d 3c 84 2b  08 ea d8 64 ea c5 53 09  |.t.Um<.+...d..S.|
+000003d0  cf e6 5f 75 7d ab 48 5d  17 03 03 00 35 1b 97 f0  |.._u}.H]....5...|
+000003e0  da 63 43 8f de 14 df 00  33 89 6e c7 3a 85 79 15  |.cC.....3.n.:.y.|
+000003f0  6e 4b c4 80 3f 6e 23 ff  85 98 b9 db c0 be 0b 4c  |nK..?n#........L|
+00000400  85 c8 bd d7 81 97 27 4b  63 cb f9 d5 3d 7a be 7b  |......'Kc...=z.{|
+00000410  a1 c6                                             |..|
+>>> Flow 3 (client to server)
+00000000  14 03 03 00 01 01 17 03  03 00 35 90 a8 14 67 6f  |..........5...go|
+00000010  57 19 0f 8d bf 48 f0 3d  a2 a8 12 e1 23 d9 ff 7c  |W....H.=....#..||
+00000020  cb 3a 62 49 3c 53 7f 83  c1 65 54 17 50 70 91 57  |.:bI<S...eT.Pp.W|
+00000030  cb 01 f8 66 af 52 ee 83  77 dc 47 21 08 6d ef e8  |...f.R..w.G!.m..|
+00000040  17 03 03 00 17 4d 04 17  19 6d 99 7b 7c 6a b1 7d  |.....M...m.{|j.}|
+00000050  81 b6 54 f7 7f 23 be 5f  fa d2 c5 8d 17 03 03 00  |..T..#._........|
+00000060  13 9c 67 89 58 55 d9 bf  ff 6e 60 d7 a5 f3 1e ae  |..g.XU...n`.....|
+00000070  f2 7f b1 65                                       |...e|
diff --git a/tls_test.go b/tls_test.go
index c91263b1..b33aa962 100644
--- a/tls_test.go
+++ b/tls_test.go
@@ -31,9 +31,9 @@ import (
 
 	"golang.org/x/crypto/cryptobyte"
 
-	"github.com/refraction-networking/utls/internal/fips140tls"
-	"github.com/refraction-networking/utls/internal/hpke"
-	"github.com/refraction-networking/utls/testenv"
+	"github.com/kernel/utls/internal/fips140tls"
+	"github.com/kernel/utls/internal/hpke"
+	"github.com/kernel/utls/testenv"
 )
 
 var rsaCertPEM = `-----BEGIN CERTIFICATE-----
diff --git a/u_certificate_originalbytes_test.go b/u_certificate_originalbytes_test.go
new file mode 100644
index 00000000..e389cc76
--- /dev/null
+++ b/u_certificate_originalbytes_test.go
@@ -0,0 +1,129 @@
+package tls
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"crypto/x509"
+	"os"
+	"testing"
+	"time"
+
+	"golang.org/x/crypto/cryptobyte"
+)
+
+// buildTLS13CertificateWithLeafExtension builds a valid TLS 1.3 Certificate
+// handshake message whose leaf certificate carries an extension that
+// marshalCertificate does not re-emit (it only re-emits OCSP and SCT).
+// Re-marshaling therefore drops the extension, so a transcript computed from
+// the re-marshal diverges from the peer's — which makes CertificateVerify fail
+// with "crypto/rsa: verification error".
+func buildTLS13CertificateWithLeafExtension() []byte {
+	var b cryptobyte.Builder
+	b.AddUint8(typeCertificate)
+	b.AddUint24LengthPrefixed(func(b *cryptobyte.Builder) {
+		b.AddUint8(0) // empty certificate_request_context
+		b.AddUint24LengthPrefixed(func(b *cryptobyte.Builder) {
+			// single leaf certificate
+			b.AddUint24LengthPrefixed(func(b *cryptobyte.Builder) {
+				b.AddBytes([]byte("dummy-leaf-der"))
+			})
+			// leaf extensions: one extension that unmarshal ignores and
+			// marshalCertificate never re-emits.
+			b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
+				b.AddUint16(0x1234) // unknown extension type
+				b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
+					b.AddBytes([]byte("ext-payload"))
+				})
+			})
+		})
+	})
+	out, err := b.Bytes()
+	if err != nil {
+		panic(err)
+	}
+	return out
+}
+
+// TestCertificateMsgTLS13PreservesOriginalBytes ensures certificateMsgTLS13
+// feeds transcriptMsg the exact bytes it was unmarshaled from, not a
+// (potentially lossy) re-marshal.
+func TestCertificateMsgTLS13PreservesOriginalBytes(t *testing.T) {
+	wire := buildTLS13CertificateWithLeafExtension()
+
+	var m certificateMsgTLS13
+	if !m.unmarshal(wire) {
+		t.Fatal("unmarshal failed")
+	}
+
+	wm, ok := handshakeMessage(&m).(handshakeMessageWithOriginalBytes)
+	if !ok {
+		t.Fatal("certificateMsgTLS13 does not implement handshakeMessageWithOriginalBytes")
+	}
+	if !bytes.Equal(wm.originalBytes(), wire) {
+		t.Fatalf("originalBytes() != wire\n orig=%x\n wire=%x", wm.originalBytes(), wire)
+	}
+
+	// Guard: the re-marshal must actually diverge from the wire, otherwise the
+	// test is no longer exercising the bug.
+	remarshaled, err := m.marshal()
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	if bytes.Equal(remarshaled, wire) {
+		t.Fatal("re-marshal unexpectedly equals wire; test no longer exercises the divergence")
+	}
+
+	// transcriptMsg must hash the original wire bytes, not the re-marshal.
+	h := sha256.New()
+	if err := transcriptMsg(&m, h); err != nil {
+		t.Fatalf("transcriptMsg: %v", err)
+	}
+	want := sha256.Sum256(wire)
+	if got := h.Sum(nil); !bytes.Equal(got, want[:]) {
+		t.Fatal("transcriptMsg hashed the re-marshal instead of the original wire bytes")
+	}
+}
+
+func TestCertificateVerifyWithUnknownCertificateEntryExtension(t *testing.T) {
+	// The recorded server flight contains an unknown extension on the leaf
+	// CertificateEntry and a CertificateVerify signature over those exact bytes.
+	fixture, err := os.Open("testdata/Client-TLSv13-CertificateEntryUnknownExtension")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fixture.Close()
+
+	flows, err := parseTestData(fixture)
+	if err != nil {
+		t.Fatalf("parse fixture: %v", err)
+	}
+
+	root, err := x509.ParseCertificate(testRSACertificateIssuer)
+	if err != nil {
+		t.Fatalf("parse root certificate: %v", err)
+	}
+	roots := x509.NewCertPool()
+	roots.AddCert(root)
+
+	config := testConfig.Clone()
+	config.MinVersion = VersionTLS13
+	config.MaxVersion = VersionTLS13
+	config.InsecureSkipVerify = false
+	config.RootCAs = roots
+	config.ServerName = "example.golang"
+	config.Time = func() time.Time { return time.Unix(1_600_000_000, 0) }
+
+	client := UClient(&replayingConn{t: t, flows: flows}, config, HelloGolang)
+	if err := client.Handshake(); err != nil {
+		t.Fatalf("handshake: %v", err)
+	}
+	if state := client.ConnectionState(); state.Version != VersionTLS13 {
+		t.Fatalf("negotiated TLS version %x, want %x", state.Version, VersionTLS13)
+	}
+	if _, err := client.Write([]byte("hello\n")); err != nil {
+		t.Fatalf("write application data: %v", err)
+	}
+	if err := client.Close(); err != nil {
+		t.Fatalf("close: %v", err)
+	}
+}
diff --git a/u_clienthello_json.go b/u_clienthello_json.go
index 027e082c..d5d4563f 100644
--- a/u_clienthello_json.go
+++ b/u_clienthello_json.go
@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/refraction-networking/utls/dicttls"
+	"github.com/kernel/utls/dicttls"
 )
 
 var ErrUnknownExtension = errors.New("extension name is unknown to the dictionary")
diff --git a/u_common.go b/u_common.go
index a9f90f75..b534540a 100644
--- a/u_common.go
+++ b/u_common.go
@@ -13,7 +13,7 @@ import (
 	"hash"
 	"log"
 
-	"github.com/refraction-networking/utls/internal/helper"
+	"github.com/kernel/utls/internal/helper"
 	"golang.org/x/crypto/cryptobyte"
 )
 
diff --git a/u_ech.go b/u_ech.go
index 27392a29..175fde94 100644
--- a/u_ech.go
+++ b/u_ech.go
@@ -8,8 +8,8 @@ import (
 	"math/big"
 	"sync"
 
-	"github.com/refraction-networking/utls/dicttls"
-	"github.com/refraction-networking/utls/internal/hpke"
+	"github.com/kernel/utls/dicttls"
+	"github.com/kernel/utls/internal/hpke"
 	"golang.org/x/crypto/cryptobyte"
 )
 
diff --git a/u_ech_test.go b/u_ech_test.go
index 967ceb27..08616268 100644
--- a/u_ech_test.go
+++ b/u_ech_test.go
@@ -5,8 +5,8 @@ import (
 	"io"
 	"testing"
 
-	tls "github.com/refraction-networking/utls"
-	"github.com/refraction-networking/utls/dicttls"
+	tls "github.com/kernel/utls"
+	"github.com/kernel/utls/dicttls"
 )
 
 func TestGREASEECHWrite(t *testing.T) {
diff --git a/u_handshake_client.go b/u_handshake_client.go
index 9928f0c3..e038aeb8 100644
--- a/u_handshake_client.go
+++ b/u_handshake_client.go
@@ -13,10 +13,10 @@ import (
 	"io"
 
 	"github.com/andybalholm/brotli"
+	"github.com/kernel/utls/internal/fips140tls"
+	"github.com/kernel/utls/internal/hpke"
+	"github.com/kernel/utls/internal/tls13"
 	"github.com/klauspost/compress/zstd"
-	"github.com/refraction-networking/utls/internal/fips140tls"
-	"github.com/refraction-networking/utls/internal/hpke"
-	"github.com/refraction-networking/utls/internal/tls13"
 )
 
 // This function is called by (*clientHandshakeStateTLS13).readServerCertificate()
diff --git a/u_hpke.go b/u_hpke.go
index e07ada27..ee7383b6 100644
--- a/u_hpke.go
+++ b/u_hpke.go
@@ -1,7 +1,7 @@
 package tls
 
 import (
-	"github.com/refraction-networking/utls/internal/hpke"
+	"github.com/kernel/utls/internal/hpke"
 )
 
 type HPKERawPublicKey = []byte
diff --git a/u_parrots.go b/u_parrots.go
index 8416fa33..247cfe23 100644
--- a/u_parrots.go
+++ b/u_parrots.go
@@ -19,7 +19,7 @@ import (
 	"sort"
 	"strconv"
 
-	"github.com/refraction-networking/utls/dicttls"
+	"github.com/kernel/utls/dicttls"
 )
 
 var ErrUnknownClientHelloID = errors.New("tls: unknown ClientHelloID")
diff --git a/u_quic_transport_parameters.go b/u_quic_transport_parameters.go
index f0e74611..51a6a706 100644
--- a/u_quic_transport_parameters.go
+++ b/u_quic_transport_parameters.go
@@ -6,7 +6,7 @@ import (
 	"math"
 	"math/big"
 
-	"github.com/refraction-networking/utls/internal/quicvarint"
+	"github.com/kernel/utls/internal/quicvarint"
 )
 
 const (
diff --git a/u_session_controller.go b/u_session_controller.go
index 1ba87b81..74adbc89 100644
--- a/u_session_controller.go
+++ b/u_session_controller.go
@@ -4,7 +4,7 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/refraction-networking/utls/internal/tls13"
+	"github.com/kernel/utls/internal/tls13"
 )
 
 // Tracking the state of calling conn.loadSession
diff --git a/u_tls_extensions.go b/u_tls_extensions.go
index 6b2ef486..f7aa28b1 100644
--- a/u_tls_extensions.go
+++ b/u_tls_extensions.go
@@ -11,7 +11,7 @@ import (
 	"io"
 	"strings"
 
-	"github.com/refraction-networking/utls/dicttls"
+	"github.com/kernel/utls/dicttls"
 	"golang.org/x/crypto/cryptobyte"
 )