diff --git a/packages/oauth-provider/src/authorize.test.ts b/packages/oauth-provider/src/authorize.test.ts
index b4f5858de8..82910f1846 100644
--- a/packages/oauth-provider/src/authorize.test.ts
+++ b/packages/oauth-provider/src/authorize.test.ts
@@ -664,6 +664,32 @@ describe("oauth authorize - ACR requests", async () => {
 				expect.any(String),
 			);
 		});
+
+		it("accepts matching value and values selectors", async () => {
+			const location = await redirectFor(undefined, {
+				essential: true,
+				value: "0",
+				values: ["0"],
+			});
+			const callbackRedirect = new URL(location);
+
+			expect(callbackRedirect.searchParams.get("error")).toBeNull();
+			expect(callbackRedirect.searchParams.get("code")).toEqual(
+				expect.any(String),
+			);
+		});
+
+		it("rejects conflicting value and values selectors", async () => {
+			const location = await redirectFor(undefined, {
+				essential: true,
+				value: "0",
+				values: ["1"],
+			});
+			const callbackRedirect = new URL(location);
+
+			expect(callbackRedirect.searchParams.get("error")).toBe("access_denied");
+			expect(callbackRedirect.searchParams.get("code")).toBeNull();
+		});
 	});
 });
 
diff --git a/packages/oauth-provider/src/claims-request.ts b/packages/oauth-provider/src/claims-request.ts
index 558c7710be..d2087ff35f 100644
--- a/packages/oauth-provider/src/claims-request.ts
+++ b/packages/oauth-provider/src/claims-request.ts
@@ -68,13 +68,11 @@ export function canSatisfyEssentialAcrRequest(
 	const acrRequest = claimsRequest.id_token?.acr;
 	if (!acrRequest || acrRequest.essential !== true) return true;
 
-	if (typeof acrRequest.value === "string") {
-		return acrRequest.value === currentAcr;
-	}
-	if (Array.isArray(acrRequest.values)) {
-		return acrRequest.values.includes(currentAcr);
-	}
-	return acrRequest.value === undefined && acrRequest.values === undefined;
+	const valueMatches =
+		acrRequest.value === undefined || acrRequest.value === currentAcr;
+	const valuesMatch =
+		acrRequest.values === undefined || acrRequest.values.includes(currentAcr);
+	return valueMatches && valuesMatch;
 }
 
 export function filterClaimsRequestUserInfoClaims(