diff --git a/CMakeLists.txt b/CMakeLists.txt
index 4fc4497..a0d7faa 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -6,7 +6,7 @@ if(NOT CMAKE_GENERATOR MATCHES "^(Ninja|Xcode)$")
 endif()
 
 cmake_minimum_required(VERSION 3.21)
-project(xone_macos VERSION 0.1.13 LANGUAGES CXX Swift)
+project(xone_macos VERSION 0.1.14 LANGUAGES CXX Swift)
 
 set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
 
diff --git a/include/auth/auth.hpp b/include/auth/auth.hpp
index 863a990..247ec4e 100644
--- a/include/auth/auth.hpp
+++ b/include/auth/auth.hpp
@@ -69,6 +69,7 @@ private:
     auto complete_handshake() -> void;
     auto handle_pkt_acknowledge() -> int;
     auto handle_pkt_data(std::span<u8 const> data) -> int;
+    auto run_deferred_action() -> void;
     auto dispatch_pkt(u8 cmd, std::span<u8 const> data) -> int;
     auto handle_hello(std::span<u8 const> data) -> int;
     auto handle_certificate(std::span<u8 const> data) -> int;
@@ -87,6 +88,14 @@ private:
     std::array<u8, k_pubkey_len> pubkey_client_{};
     std::array<u8, k_pubkey2_len> pubkey_client2_{};
     std::array<u8, k_secret_len> master_secret_{};
+
+    enum class deferred_action {
+        none,
+        exchange_rsa,
+        exchange_ecdh,
+        complete,
+    };
+    deferred_action deferred_action_ = deferred_action::none;
 };
 
 } // namespace xone::auth
diff --git a/src/auth/auth.cpp b/src/auth/auth.cpp
index 5ea66eb..b473568 100644
--- a/src/auth/auth.cpp
+++ b/src/auth/auth.cpp
@@ -367,9 +367,30 @@ auto auth::handle_pkt_data(std::span<u8 const> data) -> int
         return err;
 
     transcript_.update(data.subspan(sizeof(hdr->handshake)));
+    run_deferred_action();
     return 0;
 }
 
+auto auth::run_deferred_action() -> void
+{
+    auto action = deferred_action_;
+    deferred_action_ = deferred_action::none;
+
+    switch (action) {
+    case deferred_action::exchange_rsa:
+        exchange_rsa();
+        break;
+    case deferred_action::exchange_ecdh:
+        exchange_ecdh();
+        break;
+    case deferred_action::complete:
+        complete_handshake();
+        break;
+    case deferred_action::none:
+        break;
+    }
+}
+
 auto auth::dispatch_pkt(u8 cmd, std::span<u8 const> data) -> int
 {
     switch (cmd) {
@@ -420,7 +441,7 @@ auto auth::handle_certificate(std::span<u8 const> data) -> int
             return -EINVAL;
 
         std::memcpy(pubkey_client_.data(), data.data() + i, k_pubkey_len);
-        exchange_rsa();
+        deferred_action_ = deferred_action::exchange_rsa;
         return 0;
     }
 
@@ -443,7 +464,7 @@ auto auth::handle_finish(std::span<u8 const> data) -> int
         return -EPROTO;
     }
 
-    complete_handshake();
+    deferred_action_ = deferred_action::complete;
     return 0;
 }
 
@@ -488,7 +509,7 @@ auto auth::handle_pubkey(std::span<u8 const> data) -> int
         return -EINVAL;
 
     std::memcpy(pubkey_client2_.data(), pkt->pubkey.data(), k_pubkey2_len);
-    exchange_ecdh();
+    deferred_action_ = deferred_action::exchange_ecdh;
     return 0;
 }