diff --git a/packages/upload-api/src/access/authorize.js b/packages/upload-api/src/access/authorize.js
index 1e590b68d..7493bfad0 100644
--- a/packages/upload-api/src/access/authorize.js
+++ b/packages/upload-api/src/access/authorize.js
@@ -74,7 +74,8 @@ export const authorize = async ({ capability, invocation }, ctx) => {
       nb: {
         // we copy request details and set the `aud` field to the agent DID
         // that requested the authorization.
-        ...capability.nb,
+        iss: accountMailtoDID,
+        att: capability.nb.att,
         aud: capability.with,
         // Link to the invocation that requested the authorization.
         cause: invocation.cid,