diff --git a/src/client/player.rs b/src/client/player.rs
index a57558f..927ab1d 100644
--- a/src/client/player.rs
+++ b/src/client/player.rs
@@ -725,10 +725,19 @@ impl<'a> StreamsMapper<'a> {
                 None => match signature_cipher {
                     Some(signature_cipher) => {
                         self.cipher_to_url_params(signature_cipher).map_err(|e| {
-                            ExtractionError::InvalidData(
-                        format!("Could not deobfuscate signatureCipher `{signature_cipher}`: {e}")
-                            .into(),
-                    )
+                            // Audit follow-up to CRIT-1: keep the Deobfuscation
+                            // error class through the wrapper so `switch_client`
+                            // still trips when a cipher stream surfaces on a
+                            // client whose deobf is unavailable. The previous
+                            // `InvalidData(...)` wrapping silently demoted this
+                            // to a non-switchable error and killed the whole
+                            // player_from_clients chain on Mobile/Desktop sig paths.
+                            ExtractionError::Deobfuscation(
+                                format!(
+                                    "signatureCipher `{signature_cipher}`: {e}"
+                                )
+                                .into(),
+                            )
                         })
                     }
                     None => Err(ExtractionError::InvalidData(