diff --git a/auth2-hostbased.c b/auth2-hostbased.c
index 8a1acdec3..564a8d3cc 100644
--- a/auth2-hostbased.c
+++ b/auth2-hostbased.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-hostbased.c,v 1.57 2026/04/02 07:48:13 djm Exp $ */
+/* $OpenBSD: auth2-hostbased.c,v 1.58 2026/07/30 03:37:39 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -88,6 +88,12 @@ userauth_hostbased(struct ssh *ssh, const char *method)
 		    pkalg);
 		goto done;
 	}
+	if (match_pattern_list(pkalg,
+	    options.hostbased_accepted_algos, 0) != 1) {
+		logit_f("signature algorithm %s not in "
+		    "HostbasedAcceptedAlgorithms", pkalg);
+		goto done;
+	}
 	if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
 		error_fr(r, "key_from_blob");
 		goto done;
@@ -102,11 +108,6 @@ userauth_hostbased(struct ssh *ssh, const char *method)
 		    "(received %s, expected %s)", sshkey_ssh_name(key), pkalg);
 		goto done;
 	}
-	if (match_pattern_list(pkalg, options.hostbased_accepted_algos, 0) != 1) {
-		logit_f("signature algorithm %s not in "
-		    "HostbasedAcceptedAlgorithms", pkalg);
-		goto done;
-	}
 	if ((r = sshkey_check_cert_sigtype(key,
 	    options.ca_sign_algorithms)) != 0) {
 		logit_fr(r, "certificate signature algorithm %s",
diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index e446ef412..c15b1ba71 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-pubkey.c,v 1.126 2026/04/02 07:48:13 djm Exp $ */
+/* $OpenBSD: auth2-pubkey.c,v 1.127 2026/07/30 03:37:39 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2010 Damien Miller.  All rights reserved.
@@ -140,6 +140,11 @@ userauth_pubkey(struct ssh *ssh, const char *method)
 		verbose_f("unsupported public key algorithm: %s", pkalg);
 		goto done;
 	}
+	if (match_pattern_list(pkalg, options.pubkey_accepted_algos, 0) != 1) {
+		logit_f("signature algorithm %s not in "
+		    "PubkeyAcceptedAlgorithms", pkalg);
+		goto done;
+	}
 	if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
 		error_fr(r, "parse key");
 		goto done;
@@ -158,11 +163,6 @@ userauth_pubkey(struct ssh *ssh, const char *method)
 		logit("refusing previously-used %s key", sshkey_type(key));
 		goto done;
 	}
-	if (match_pattern_list(pkalg, options.pubkey_accepted_algos, 0) != 1) {
-		logit_f("signature algorithm %s not in "
-		    "PubkeyAcceptedAlgorithms", pkalg);
-		goto done;
-	}
 	if ((r = sshkey_check_cert_sigtype(key,
 	    options.ca_sign_algorithms)) != 0) {
 		logit_fr(r, "certificate signature algorithm %s",