diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml
index 77276d74..be34c096 100644
--- a/.github/workflows/conformance.yml
+++ b/.github/workflows/conformance.yml
@@ -14,7 +14,7 @@ permissions:
   contents: read
 
 env:
-  CONFORMANCE_VERSION: "0.2.0-alpha.9"
+  CONFORMANCE_VERSION: "0.2.0-alpha.10"
 
 jobs:
   server-conformance:
diff --git a/conformance/baseline.yml b/conformance/baseline.yml
index b516fc92..4867fe99 100644
--- a/conformance/baseline.yml
+++ b/conformance/baseline.yml
@@ -1,29 +1,14 @@
-server:
-  # The `server-stateless` scenario ships with the `@modelcontextprotocol/conformance@0.2.0-alpha.9`
-  # suite pinned by the workflow, which still enforces the pre-PR-3002
-  # (https://github.com/modelcontextprotocol/modelcontextprotocol/pull/3002) spec:
-  #   - `clientInfo` in the per-request `_meta` is required (MUST).
-  #   - `serverInfo` is a body field on `DiscoverResult`.
-  # PR #3002 relaxes `clientInfo` to SHOULD and moves `serverInfo` into every
-  # response's `_meta`. The Go SDK follows the updated spec, so the following
-  # checks in the `server-stateless` scenario fail against the pinned suite:
-  #   - sep-2575-request-meta-invalid-missing-client-info
-  #   - sep-2575-http-server-meta-invalid-400
-  #   - sep-2575-server-implements-discover
-  # Remove this entry when the conformance suite is bumped to a release that
-  # incorporates PR #3002.
-  - server-stateless
-
 client:
   # OAuth mechanisms not implemented by the Go MCP SDK.
   - auth/client-credentials-basic
   - auth/client-credentials-jwt
   - auth/enterprise-managed-authorization
 
-  # Upstream conformance mock inconsistency: the scenario's hand-rolled
-  # server/discover handler advertises "2026-07-28" but delegates every
-  # other method to a pinned @modelcontextprotocol/sdk that rejects that
-  # version at the HTTP layer.
-  # Remove this entry when the conformance suite is bumped to a release that
-  # fixes this issue.
-  - json-schema-ref-no-deref
+  # SEP-1932 (DPoP Sender-Constrained Tokens) client-side support not yet
+  # implemented by the Go MCP SDK.
+  - auth/dpop
+  - auth/dpop-nonce
+
+  # SEP-1933 (Workload Identity Federation JWT-bearer) client-side support
+  # not yet implemented by the Go MCP SDK.
+  - auth/wif-jwt-bearer