diff --git a/examples/demo-app/components/SessionCreator.vue b/examples/demo-app/components/SessionCreator.vue
index b1560842..cfcb368a 100644
--- a/examples/demo-app/components/SessionCreator.vue
+++ b/examples/demo-app/components/SessionCreator.vue
@@ -71,9 +71,10 @@
 
 <script setup lang="ts">
 import { ref, computed } from "vue";
-import { createPublicClient, http, parseEther, type Chain, type Address } from "viem";
+import { createPublicClient, http, parseEther, type Address, type Chain, encodePacked, keccak256, pad } from "viem";
 import { createBundlerClient } from "viem/account-abstraction";
-import { createSession, toEcdsaSmartAccount, LimitType } from "zksync-sso-4337/client";
+import { privateKeyToAccount } from "viem/accounts";
+import { createSession, toEcdsaSmartAccount, LimitType, getSessionHash } from "zksync-sso-4337/client";
 
 interface SessionConfig {
   enabled: boolean;
@@ -234,11 +235,28 @@ async function createSessionOnChain() {
 
     // eslint-disable-next-line no-console
     console.log("Session spec created:", sessionSpec);
+
+    // Generate proof
+    const sessionHash = getSessionHash(sessionSpec);
+
+    // Sign over (sessionHash, account) to bind session to account
+    // Matches Rust: keccak256([session_hash, account.address().into_word()].concat())
+    const digest = keccak256(encodePacked(
+      ["bytes32", "bytes32"],
+      [sessionHash, pad(props.accountAddress as Address)],
+    ));
+
+    const sessionSignerAccount = privateKeyToAccount(props.sessionConfig.sessionPrivateKey as `0x${string}`);
+    const proof = await sessionSignerAccount.sign({
+      hash: digest,
+    });
+
     // eslint-disable-next-line no-console
     console.log("Calling createSession with:", {
       bundlerClient: !!bundlerClient,
       sessionSpec: !!sessionSpec,
       sessionValidator: props.sessionConfig.validatorAddress,
+      proof,
     });
 
     // Create the session on-chain
@@ -246,6 +264,7 @@ async function createSessionOnChain() {
     try {
       sessionResult = await createSession(bundlerClient, {
         sessionSpec,
+        proof,
         contracts: {
           sessionValidator: props.sessionConfig.validatorAddress as Address,
         },
@@ -268,6 +287,13 @@ async function createSessionOnChain() {
     // eslint-disable-next-line no-console
     console.log("Session created successfully! UserOp hash:", userOpHash);
 
+    // Wait for the UserOp to be mined
+    // eslint-disable-next-line no-console
+    console.log("Waiting for session creation UserOp to be mined...");
+    await bundlerClient.waitForUserOperationReceipt({ hash: userOpHash });
+    // eslint-disable-next-line no-console
+    console.log("Session creation UserOp mined!");
+
     result.value = { userOpHash };
     sessionCreated.value = true;
     emit("sessionCreated");
diff --git a/packages/erc4337-contracts b/packages/erc4337-contracts
index 403bc202..03f2ceaa 160000
--- a/packages/erc4337-contracts
+++ b/packages/erc4337-contracts
@@ -1 +1 @@
-Subproject commit 403bc202f768f56faec540ee661f069f96eaa76c
+Subproject commit 03f2ceaac1ea0de7426891d6cfe22649e43346ec
diff --git a/packages/sdk-4337/src/abi/SessionKeyValidator.ts b/packages/sdk-4337/src/abi/SessionKeyValidator.ts
index 673c64c9..1ca579bd 100644
--- a/packages/sdk-4337/src/abi/SessionKeyValidator.ts
+++ b/packages/sdk-4337/src/abi/SessionKeyValidator.ts
@@ -129,6 +129,10 @@ export const SessionKeyValidatorAbi = [{
         }],
       }],
     }],
+  }, {
+    name: "proof",
+    type: "bytes",
+    internalType: "bytes",
   }],
   outputs: [],
   stateMutability: "nonpayable",
diff --git a/packages/sdk-4337/src/client/actions/sessions.ts b/packages/sdk-4337/src/client/actions/sessions.ts
index c8a86cf7..e528fdc3 100644
--- a/packages/sdk-4337/src/client/actions/sessions.ts
+++ b/packages/sdk-4337/src/client/actions/sessions.ts
@@ -23,6 +23,11 @@ export type CreateSessionParams = {
    */
   sessionSpec: SessionSpec;
 
+  /**
+   * Proof of session key ownership (signature of session hash by session key)
+   */
+  proof: Hex;
+
   /**
    * Contract addresses
    */
@@ -82,6 +87,7 @@ export type CreateSessionReturnType = {
  *     ],
  *     transferPolicies: [],
  *   },
+ *   proof: "0x...", // Signature of session hash by session key
  *   contracts: {
  *     sessionValidator: "0x...", // SessionKeyValidator module address
  *   },
@@ -96,7 +102,7 @@ export async function createSession<
   client: Client<TTransport, TChain, TAccount>,
   params: CreateSessionParams,
 ): Promise<CreateSessionReturnType> {
-  const { sessionSpec, contracts } = params;
+  const { sessionSpec, proof, contracts } = params;
 
   if (!client.account) {
     throw new Error("Client must have an account");
@@ -104,7 +110,7 @@ export async function createSession<
 
   // Convert SessionSpec into JSON string expected by wasm helper
   const sessionSpecJSON = sessionSpecToJSON(sessionSpec);
-  const callData = encode_create_session_call_data(sessionSpecJSON) as Hex;
+  const callData = encode_create_session_call_data(sessionSpecJSON, proof) as Hex;
   // Send the UserOperation to create the session using the bundler client method.
   // Note: We explicitly pass the account for broader viem compatibility.
   const bundler = client as unknown as {
diff --git a/packages/sdk-4337/src/client/passkey/client-actions.ts b/packages/sdk-4337/src/client/passkey/client-actions.ts
index 4b4958ec..72c5a835 100644
--- a/packages/sdk-4337/src/client/passkey/client-actions.ts
+++ b/packages/sdk-4337/src/client/passkey/client-actions.ts
@@ -50,7 +50,7 @@ export type PasskeyClientActions<TChain extends Chain = Chain, TAccount extends
   /**
    * Create a session on-chain using the provided specification
    */
-  createSession: (params: { sessionSpec: SessionSpec; contracts: { sessionValidator: Address } }) => Promise<Hash>;
+  createSession: (params: { sessionSpec: SessionSpec; proof: Hex; contracts: { sessionValidator: Address } }) => Promise<Hash>;
 };
 
 /**
@@ -93,11 +93,11 @@ export function passkeyClientActions<
     },
 
     // Create a session on-chain using the provided specification
-    createSession: async (params: { sessionSpec: SessionSpec; contracts: { sessionValidator: Address } }) => {
+    createSession: async (params: { sessionSpec: SessionSpec; proof: Hex; contracts: { sessionValidator: Address } }) => {
       // Build smart account instance (lazy, not cached here; acceptable overhead for now)
       const smartAccount = await toPasskeySmartAccount(config.passkeyAccount);
       const sessionSpecJSON = sessionSpecToJSON(params.sessionSpec);
-      const callData = encode_create_session_call_data(sessionSpecJSON) as unknown as `0x${string}`;
+      const callData = encode_create_session_call_data(sessionSpecJSON, params.proof) as unknown as `0x${string}`;
       const userOpHash = await config.bundler.sendUserOperation({
         account: smartAccount,
         calls: [
diff --git a/packages/sdk-4337/src/client/session/session.test.ts b/packages/sdk-4337/src/client/session/session.test.ts
index 9bf7830e..f904e67b 100644
--- a/packages/sdk-4337/src/client/session/session.test.ts
+++ b/packages/sdk-4337/src/client/session/session.test.ts
@@ -116,7 +116,7 @@ describe("Session Utils", () => {
       const parsed = JSON.parse(json);
       expect(parsed.signer).toBe(signer);
       expect(typeof parsed.expiresAt).toBe("string"); // bigints as strings
-      expect(parsed.feeLimit.limitType).toBe(0); // LimitType.Unlimited = 0
+      expect(parsed.feeLimit.limitType).toBe("Unlimited"); // LimitType.Unlimited
     });
 
     it("should handle complex session spec with policies", () => {
@@ -148,7 +148,7 @@ describe("Session Utils", () => {
 
       expect(parsed.callPolicies).toHaveLength(1);
       expect(parsed.transferPolicies).toHaveLength(1);
-      expect(parsed.feeLimit.limitType).toBe(1); // LimitType.Lifetime = 1
+      expect(parsed.feeLimit.limitType).toBe("Lifetime"); // LimitType.Lifetime
       expect(parsed.feeLimit.limit).toBe("1000000000000000000");
     });
   });
diff --git a/packages/sdk-4337/src/client/session/types.ts b/packages/sdk-4337/src/client/session/types.ts
index 26d3c4c6..daefc1a9 100644
--- a/packages/sdk-4337/src/client/session/types.ts
+++ b/packages/sdk-4337/src/client/session/types.ts
@@ -2,12 +2,12 @@ import type { Address, Hex } from "viem";
 
 /**
  * Limit types for usage tracking
- * Uses string values to match Rust serialization format
+ * Uses numeric values to match contract enum
  */
 export enum LimitType {
-  Unlimited = "Unlimited",
-  Lifetime = "Lifetime",
-  Allowance = "Allowance",
+  Unlimited = 0,
+  Lifetime = 1,
+  Allowance = 2,
 }
 
 /**
diff --git a/packages/sdk-4337/src/client/session/utils.ts b/packages/sdk-4337/src/client/session/utils.ts
index bc18f68a..bfb6f715 100644
--- a/packages/sdk-4337/src/client/session/utils.ts
+++ b/packages/sdk-4337/src/client/session/utils.ts
@@ -1,6 +1,7 @@
-import type { Address, Hex } from "viem";
+import { type Address, encodeAbiParameters, type Hex, keccak256 } from "viem";
 
-import type { SessionSpec, UsageLimit } from "./types.js";
+import { SessionKeyValidatorAbi } from "../../abi/SessionKeyValidator.js";
+import { LimitType, type SessionSpec, type UsageLimit } from "./types.js";
 
 /**
  * Utility type that converts all bigint values to strings recursively
@@ -23,11 +24,17 @@ export type SessionSpecJSON = ConvertBigIntToString<SessionSpec>;
  * All bigint values are converted to strings for safe serialization.
  */
 export function sessionSpecToJSON(spec: SessionSpec): string {
-  const usageLimitToJSON = (limit: UsageLimit) => ({
-    limitType: limit.limitType,
-    limit: limit.limit.toString(),
-    period: limit.period.toString(),
-  });
+  const usageLimitToJSON = (limit: UsageLimit) => {
+    let limitType = "Unlimited";
+    if (limit.limitType === LimitType.Lifetime) limitType = "Lifetime";
+    else if (limit.limitType === LimitType.Allowance) limitType = "Allowance";
+
+    return {
+      limitType,
+      limit: limit.limit.toString(),
+      period: limit.period.toString(),
+    };
+  };
 
   return JSON.stringify({
     signer: spec.signer,
@@ -130,3 +137,24 @@ export function isSessionExpired(
 export function getSessionExpiryDate(spec: SessionSpec): Date {
   return new Date(Number(spec.expiresAt) * 1000);
 }
+
+/**
+ * Computes the hash of a session specification.
+ * This hash is signed by the session key to prove ownership.
+ */
+export function getSessionHash(spec: SessionSpec): Hex {
+  const createSessionFunction = SessionKeyValidatorAbi.find(
+    (x) => x.type === "function" && x.name === "createSession",
+  );
+  if (!createSessionFunction) throw new Error("createSession function not found in SessionKeyValidator ABI");
+
+  const sessionSpecParam = createSessionFunction.inputs.find((x) => x.name === "sessionSpec");
+  if (!sessionSpecParam) throw new Error("sessionSpec parameter not found in createSession function inputs");
+
+  const encoded = encodeAbiParameters(
+    [sessionSpecParam],
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    [spec as any],
+  );
+  return keccak256(encoded);
+}
diff --git a/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/deploy.rs b/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/deploy.rs
index 85a35a7d..9bc89914 100644
--- a/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/deploy.rs
+++ b/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/deploy.rs
@@ -218,6 +218,7 @@ mod tests {
                     calls::{Execution, encode_calls},
                     module::{
                         Module,
+                        add::{AddModuleParams, AddModulePayload, add_module},
                         installed::{
                             IsModuleInstalledParams, is_module_installed,
                         },
@@ -246,8 +247,9 @@ mod tests {
         },
     };
     use alloy::{
-        primitives::{U256, Uint, address},
-        signers::local::PrivateKeySigner,
+        primitives::{U256, Uint, address, keccak256},
+        signers::{SignerSync, local::PrivateKeySigner},
+        sol_types::SolValue,
     };
     use std::{future::Future, pin::Pin, str::FromStr, sync::Arc};
 
@@ -458,30 +460,27 @@ mod tests {
             PrivateKeySigner::from_str(session_key_hex)?.address();
         println!("Session signer address: {}", session_signer_address);
 
-        // Deploy account WITH session validator pre-installed
+        // Deploy account WITHOUT session validator pre-installed
         let signers =
             vec![address!("0xa0Ee7A142d267C1f36714E4a8F75612F20a79720")];
         let eoa_signers = EOASigners {
             addresses: signers,
             validator_address: eoa_validator_address,
         };
-        let session_config = SessionValidatorConfig {
-            validator_address: session_validator_address,
-        };
 
         let address = deploy_account(DeployAccountParams {
             factory_address,
             eoa_signers: Some(eoa_signers),
             webauthn_signer: None,
-            session_validator: Some(session_config),
+            session_validator: None,
             id: None,
             provider: provider.clone(),
         })
         .await?;
 
-        println!("✓ Account deployed with session validator pre-installed");
+        println!("✓ Account deployed (without session validator)");
 
-        // Verify both modules are installed
+        // Verify EOA module is installed
         let is_eoa_installed = is_module_installed(IsModuleInstalledParams {
             module: Module::eoa_validator(eoa_validator_address),
             account: address,
@@ -490,6 +489,31 @@ mod tests {
         .await?;
         eyre::ensure!(is_eoa_installed, "EOA validator not installed");
 
+        // Fund the account
+        fund_account_with_default_amount(address, provider.clone()).await?;
+        println!("✓ Account funded");
+
+        // Create EOA signer
+        let eoa_signer = create_eoa_signer(
+            signer_private_key.clone(),
+            eoa_validator_address,
+        )?;
+
+        // Install Session Validator Module
+        add_module(AddModuleParams {
+            account_address: address,
+            module: AddModulePayload::session_key(session_validator_address),
+            entry_point_address,
+            paymaster: None,
+            provider: provider.clone(),
+            bundler_client: bundler_client.clone(),
+            signer: eoa_signer.clone(),
+        })
+        .await?;
+
+        println!("✓ Session validator installed");
+
+        // Verify session module is installed
         let is_session_installed =
             is_module_installed(IsModuleInstalledParams {
                 module: Module::session_key_validator(
@@ -503,16 +527,6 @@ mod tests {
 
         println!("✓ Both EOA and Session validators verified as installed");
 
-        // Fund the account
-        fund_account_with_default_amount(address, provider.clone()).await?;
-        println!("✓ Account funded");
-
-        // Create a session using EOA signer
-        let eoa_signer = create_eoa_signer(
-            signer_private_key.clone(),
-            eoa_validator_address,
-        )?;
-
         let expires_at = Uint::from(2088558400u64); // Year 2036
         let target = address!("0xa0Ee7A142d267C1f36714E4a8F75612F20a79720");
 
@@ -536,6 +550,16 @@ mod tests {
             }],
         };
 
+        // Calculate proof
+        let session_lib_spec: crate::erc4337::account::modular_smart_account::session::contract::SessionLib::SessionSpec = session_spec.clone().into();
+        let session_hash = keccak256(session_lib_spec.abi_encode());
+        let digest = keccak256((session_hash, address).abi_encode());
+
+        let session_signer_instance =
+            PrivateKeySigner::from_str(session_key_hex)?;
+        let proof =
+            session_signer_instance.sign_hash_sync(&digest)?.as_bytes().into();
+
         create_session(CreateSessionParams {
             account_address: address,
             spec: session_spec.clone(),
@@ -545,6 +569,7 @@ mod tests {
             bundler_client: bundler_client.clone(),
             provider: provider.clone(),
             signer: eoa_signer,
+            proof,
         })
         .await?;
 
diff --git a/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/guardian/recovery/finalize.rs b/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/guardian/recovery/finalize.rs
index 5ed51727..5045836c 100644
--- a/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/guardian/recovery/finalize.rs
+++ b/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/guardian/recovery/finalize.rs
@@ -1,12 +1,15 @@
 use crate::erc4337::account::modular_smart_account::guardian::contract::GuardianExecutor;
 use alloy::{
-    primitives::Address, providers::Provider, rpc::types::TransactionReceipt,
+    primitives::{Address, Bytes},
+    providers::Provider,
+    rpc::types::TransactionReceipt,
 };
 
 #[derive(Clone)]
 pub struct FinalizeRecoveryParams<P: Provider + Send + Sync + Clone> {
     pub guardian_executor: Address,
     pub account: Address,
+    pub data: Bytes,
     pub guardian_provider: P,
 }
 
@@ -19,6 +22,7 @@ where
     let FinalizeRecoveryParams {
         guardian_executor,
         account,
+        data,
         guardian_provider,
     } = params;
 
@@ -26,7 +30,7 @@ where
         GuardianExecutor::new(guardian_executor, guardian_provider);
 
     let receipt = guardian_executor_instance
-        .finalizeRecovery(account)
+        .finalizeRecovery(account, data)
         .send()
         .await?
         .get_receipt()
@@ -197,14 +201,14 @@ mod tests {
             address!("0x14dC79964da2C08b23698B3D3cc7Ca32193d9955");
 
         // Initialize recovery directly
+        let initialize_recovery_data: Bytes =
+            new_owner_address.abi_encode().into();
         {
-            let initialize_recovery_data =
-                new_owner_address.abi_encode().into();
             initialize_recovery(InitializeRecoveryParams {
                 guardian_executor: guardian_module,
                 account: account_address,
                 recovery_type: RecoveryType::EOA,
-                data: initialize_recovery_data,
+                data: initialize_recovery_data.clone(),
                 guardian_provider: guardian_provider.clone(),
             })
             .await?;
@@ -223,6 +227,7 @@ mod tests {
         finalize_recovery(FinalizeRecoveryParams {
             guardian_executor: guardian_module,
             account: account_address,
+            data: initialize_recovery_data,
             guardian_provider: guardian_provider.clone(),
         })
         .await?;
diff --git a/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/session.rs b/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/session.rs
index 7dea7d74..b0894a4f 100644
--- a/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/session.rs
+++ b/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/session.rs
@@ -11,4 +11,4 @@ pub mod signature_wasm;
 pub mod state;
 pub mod status;
 
-mod contract;
+pub mod contract;
diff --git a/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/session/active.rs b/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/session/active.rs
index b8bdb361..1b49c170 100644
--- a/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/session/active.rs
+++ b/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/session/active.rs
@@ -144,10 +144,12 @@ mod tests {
         },
     };
     use alloy::{
-        primitives::{FixedBytes, U256, Uint, address},
+        primitives::{FixedBytes, U256, Uint, address, keccak256},
         rpc::types::{BlockNumberOrTag, FilterBlockOption, FilterSet},
+        signers::{SignerSync, local::PrivateKeySigner},
+        sol_types::SolValue,
     };
-    use std::collections::HashSet;
+    use std::{collections::HashSet, str::FromStr};
 
     fn create_session_logs_filter(
         session_key_validator_address: Address,
@@ -270,11 +272,12 @@ mod tests {
 
         // Create first session (will remain active)
         let session_spec_1 = {
-            let signer_address =
-                address!("0xa0Ee7A142d267C1f36714E4a8F75612F20a79720");
+            let signer_key =
+                PrivateKeySigner::from_str(&signer_private_key).unwrap();
+            let signer_address = signer_key.address();
             let expires_at = Uint::from(2088558400u64);
             let target = address!("0xa0Ee7A142d267C1f36714E4a8F75612F20a79720");
-            SessionSpec {
+            let spec = SessionSpec {
                 signer: signer_address,
                 expires_at,
                 call_policies: vec![],
@@ -292,30 +295,39 @@ mod tests {
                         period: Uint::from(0),
                     },
                 }],
-            }
-        };
+            };
 
-        create_session(CreateSessionParams {
-            account_address,
-            spec: session_spec_1.clone(),
-            entry_point_address,
-            session_key_validator: session_key_module,
-            paymaster: None,
-            bundler_client: bundler_client.clone(),
-            provider: provider.clone(),
-            signer: signer.clone(),
-        })
-        .await?;
+            let session_hash = hash_session(spec.clone());
+            let hash_to_sign =
+                keccak256((session_hash, account_address).abi_encode());
+            let signature = signer_key.sign_hash_sync(&hash_to_sign).unwrap();
+            let proof = signature.as_bytes();
+
+            create_session(CreateSessionParams {
+                account_address,
+                spec: spec.clone(),
+                entry_point_address,
+                session_key_validator: session_key_module,
+                paymaster: None,
+                bundler_client: bundler_client.clone(),
+                provider: provider.clone(),
+                signer: signer.clone(),
+                proof: proof.into(),
+            })
+            .await?;
+
+            spec
+        };
 
         println!("Session 1 created");
 
         // Create second session (will be revoked)
         let session_spec_2 = {
-            let signer_address =
-                address!("0xb0Ee7A142d267C1f36714E4a8F75612F20a79721");
+            let signer_key = PrivateKeySigner::random();
+            let signer_address = signer_key.address();
             let expires_at = Uint::from(2088558400u64);
             let target = address!("0xb0Ee7A142d267C1f36714E4a8F75612F20a79721");
-            SessionSpec {
+            let spec = SessionSpec {
                 signer: signer_address,
                 expires_at,
                 call_policies: vec![],
@@ -333,30 +345,39 @@ mod tests {
                         period: Uint::from(0),
                     },
                 }],
-            }
-        };
+            };
 
-        create_session(CreateSessionParams {
-            account_address,
-            spec: session_spec_2.clone(),
-            entry_point_address,
-            session_key_validator: session_key_module,
-            paymaster: None,
-            bundler_client: bundler_client.clone(),
-            provider: provider.clone(),
-            signer: signer.clone(),
-        })
-        .await?;
+            let session_hash = hash_session(spec.clone());
+            let hash_to_sign =
+                keccak256((session_hash, account_address).abi_encode());
+            let signature = signer_key.sign_hash_sync(&hash_to_sign).unwrap();
+            let proof = signature.as_bytes();
+
+            create_session(CreateSessionParams {
+                account_address,
+                spec: spec.clone(),
+                entry_point_address,
+                session_key_validator: session_key_module,
+                paymaster: None,
+                bundler_client: bundler_client.clone(),
+                provider: provider.clone(),
+                signer: signer.clone(),
+                proof: proof.into(),
+            })
+            .await?;
+
+            spec
+        };
 
         println!("Session 2 created");
 
         // Create third session (will remain active)
         let session_spec_3 = {
-            let signer_address =
-                address!("0xc0Ee7A142d267C1f36714E4a8F75612F20a79722");
+            let signer_key = PrivateKeySigner::random();
+            let signer_address = signer_key.address();
             let expires_at = Uint::from(2088558400u64);
             let target = address!("0xc0Ee7A142d267C1f36714E4a8F75612F20a79722");
-            SessionSpec {
+            let spec = SessionSpec {
                 signer: signer_address,
                 expires_at,
                 call_policies: vec![],
@@ -374,20 +395,29 @@ mod tests {
                         period: Uint::from(0),
                     },
                 }],
-            }
-        };
+            };
 
-        create_session(CreateSessionParams {
-            account_address,
-            spec: session_spec_3.clone(),
-            entry_point_address,
-            session_key_validator: session_key_module,
-            paymaster: None,
-            bundler_client: bundler_client.clone(),
-            provider: provider.clone(),
-            signer: signer.clone(),
-        })
-        .await?;
+            let session_hash = hash_session(spec.clone());
+            let hash_to_sign =
+                keccak256((session_hash, account_address).abi_encode());
+            let signature = signer_key.sign_hash_sync(&hash_to_sign).unwrap();
+            let proof = signature.as_bytes();
+
+            create_session(CreateSessionParams {
+                account_address,
+                spec: spec.clone(),
+                entry_point_address,
+                session_key_validator: session_key_module,
+                paymaster: None,
+                bundler_client: bundler_client.clone(),
+                provider: provider.clone(),
+                signer: signer.clone(),
+                proof: proof.into(),
+            })
+            .await?;
+
+            spec
+        };
 
         println!("Session 3 created");
 
diff --git a/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/session/create.rs b/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/session/create.rs
index 1475fe6f..01f699a6 100644
--- a/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/session/create.rs
+++ b/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/session/create.rs
@@ -23,6 +23,7 @@ use alloy::{
 pub struct CreateSessionParams<P: Provider + Send + Sync + Clone> {
     pub account_address: Address,
     pub spec: SessionSpec,
+    pub proof: Bytes,
     pub entry_point_address: Address,
     pub session_key_validator: Address,
     pub paymaster: Option<PaymasterParams>,
@@ -40,6 +41,7 @@ where
     let CreateSessionParams {
         account_address,
         spec,
+        proof,
         entry_point_address,
         session_key_validator,
         paymaster,
@@ -48,7 +50,7 @@ where
         signer,
     } = params;
 
-    let call_data = add_session_call_data(spec, session_key_validator);
+    let call_data = add_session_call_data(spec, proof, session_key_validator);
 
     send_user_op(SendUserOpParams {
         account: account_address,
@@ -66,17 +68,18 @@ where
     Ok(())
 }
 
-pub fn create_session_call_data(spec: SessionSpec) -> Bytes {
-    SessionKeyValidator::createSessionCall { sessionSpec: spec.into() }
+pub fn create_session_call_data(spec: SessionSpec, proof: Bytes) -> Bytes {
+    SessionKeyValidator::createSessionCall { sessionSpec: spec.into(), proof }
         .abi_encode()
         .into()
 }
 
 fn add_session_call_data(
     spec: SessionSpec,
+    proof: Bytes,
     session_key_validator: Address,
 ) -> Bytes {
-    let calldata = create_session_call_data(spec);
+    let calldata = create_session_call_data(spec, proof);
     encoded_call_with_target_and_data(session_key_validator, calldata)
 }
 
@@ -97,9 +100,12 @@ mod tests {
                         deploy_account,
                     },
                     passkey::add::PasskeyPayload,
-                    session::session_lib::session_spec::{
-                        limit_type::LimitType, transfer_spec::TransferSpec,
-                        usage_limit::UsageLimit,
+                    session::{
+                        contract::SessionLib,
+                        session_lib::session_spec::{
+                            limit_type::LimitType, transfer_spec::TransferSpec,
+                            usage_limit::UsageLimit,
+                        },
                     },
                     test_utilities::fund_account_with_default_amount,
                 },
@@ -113,7 +119,29 @@ mod tests {
             start_anvil_and_deploy_contracts_and_start_bundler_with_config,
         },
     };
-    use alloy::primitives::{U256, Uint, address, bytes, fixed_bytes};
+    use alloy::{
+        primitives::{
+            Address, Bytes, U256, Uint, address, bytes, fixed_bytes, keccak256,
+        },
+        signers::{SignerSync, local::PrivateKeySigner},
+        sol_types::SolValue,
+    };
+    use std::str::FromStr;
+
+    fn generate_session_proof(
+        session_spec: &SessionSpec,
+        account_address: Address,
+        signer_private_key: &str,
+    ) -> eyre::Result<Bytes> {
+        let session_lib_spec: SessionLib::SessionSpec =
+            session_spec.clone().into();
+        let session_hash = keccak256(session_lib_spec.abi_encode());
+        let digest = keccak256((session_hash, account_address).abi_encode());
+
+        let session_signer_instance =
+            PrivateKeySigner::from_str(signer_private_key)?;
+        Ok(session_signer_instance.sign_hash_sync(&digest)?.as_bytes().into())
+    }
 
     #[tokio::test]
     async fn test_create_session() -> eyre::Result<()> {
@@ -241,6 +269,13 @@ mod tests {
                 }],
             };
 
+            // Calculate proof
+            let proof = generate_session_proof(
+                &session_spec,
+                address,
+                &signer_private_key,
+            )?;
+
             create_session(CreateSessionParams {
                 account_address: address,
                 spec: session_spec,
@@ -250,6 +285,7 @@ mod tests {
                 bundler_client,
                 provider,
                 signer,
+                proof,
             })
             .await?;
         }
@@ -269,7 +305,7 @@ mod tests {
             anvil_instance,
             provider,
             contracts,
-            _,
+            signer_private_key,
             bundler,
             bundler_client,
         ) = {
@@ -388,6 +424,13 @@ mod tests {
                 }],
             };
 
+            // Calculate proof
+            let proof = generate_session_proof(
+                &session_spec,
+                address,
+                &signer_private_key,
+            )?;
+
             create_session(CreateSessionParams {
                 account_address: address,
                 spec: session_spec,
@@ -397,6 +440,7 @@ mod tests {
                 bundler_client,
                 provider,
                 signer: signer.clone(),
+                proof,
             })
             .await?;
         }
diff --git a/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/session/revoke.rs b/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/session/revoke.rs
index 6cfac581..9f17b29b 100644
--- a/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/session/revoke.rs
+++ b/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/session/revoke.rs
@@ -115,7 +115,12 @@ mod tests {
             start_anvil_and_deploy_contracts_and_start_bundler_with_config,
         },
     };
-    use alloy::primitives::{U256, Uint, address, bytes, fixed_bytes};
+    use alloy::{
+        primitives::{U256, Uint, address, bytes, fixed_bytes, keccak256},
+        signers::{SignerSync, local::PrivateKeySigner},
+        sol_types::SolValue,
+    };
+    use std::str::FromStr;
 
     #[tokio::test]
     async fn test_revoke_session() -> eyre::Result<()> {
@@ -242,6 +247,13 @@ mod tests {
                 }],
             };
 
+            let session_hash = hash_session(session_spec.clone());
+            let hash_to_sign = keccak256((session_hash, address).abi_encode());
+            let signer_key =
+                PrivateKeySigner::from_str(&signer_private_key).unwrap();
+            let signature = signer_key.sign_hash_sync(&hash_to_sign).unwrap();
+            let proof = signature.as_bytes();
+
             create_session(CreateSessionParams {
                 account_address: address,
                 spec: session_spec.clone(),
@@ -251,6 +263,7 @@ mod tests {
                 bundler_client: bundler_client.clone(),
                 provider: provider.clone(),
                 signer: signer.clone(),
+                proof: proof.into(),
             })
             .await?;
 
@@ -295,6 +308,7 @@ mod tests {
 
     #[tokio::test]
     async fn test_create_session_with_webauthn() -> eyre::Result<()> {
+        let signer_private_key = "0x2a871d0798f97d79848a013d4936a73bf4cc922c825d33c1cf7073dff6d409c6".to_string();
         let (
             _,
             anvil_instance,
@@ -304,7 +318,6 @@ mod tests {
             bundler,
             bundler_client,
         ) = {
-            let signer_private_key = "0x2a871d0798f97d79848a013d4936a73bf4cc922c825d33c1cf7073dff6d409c6".to_string();
             let config = TestInfraConfig {
                 signer_private_key: signer_private_key.clone(),
             };
@@ -418,6 +431,13 @@ mod tests {
             }],
         };
 
+        let session_hash = hash_session(session_spec.clone());
+        let hash_to_sign = keccak256((session_hash, address).abi_encode());
+        let signer_key =
+            PrivateKeySigner::from_str(&signer_private_key).unwrap();
+        let signature = signer_key.sign_hash_sync(&hash_to_sign).unwrap();
+        let proof = signature.as_bytes();
+
         create_session(CreateSessionParams {
             account_address: address,
             spec: session_spec.clone(),
@@ -427,6 +447,7 @@ mod tests {
             bundler_client: bundler_client.clone(),
             provider: provider.clone(),
             signer: signer.clone(),
+            proof: proof.into(),
         })
         .await?;
 
diff --git a/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/session/send.rs b/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/session/send.rs
index fe632374..7b20b57c 100644
--- a/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/session/send.rs
+++ b/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-core/src/erc4337/account/modular_smart_account/session/send.rs
@@ -26,6 +26,7 @@ mod tests {
                     send::{SendUserOpParams, send_user_op},
                     session::{
                         create::{CreateSessionParams, create_session},
+                        hash::hash_session,
                         session_lib::session_spec::{
                             SessionSpec, limit_type::LimitType,
                             transfer_spec::TransferSpec,
@@ -44,8 +45,9 @@ mod tests {
         },
     };
     use alloy::{
-        primitives::{Bytes, FixedBytes, U256, Uint, address},
-        signers::local::PrivateKeySigner,
+        primitives::{Bytes, FixedBytes, U256, Uint, address, keccak256},
+        signers::{SignerSync, local::PrivateKeySigner},
+        sol_types::SolValue,
     };
     use std::{future::Future, pin::Pin, str::FromStr, sync::Arc};
 
@@ -199,6 +201,12 @@ mod tests {
             }],
         };
 
+        let session_hash = hash_session(session_spec.clone());
+        let hash_to_sign = keccak256((session_hash, address).abi_encode());
+        let signer_key = PrivateKeySigner::from_str(session_key_hex).unwrap();
+        let signature = signer_key.sign_hash_sync(&hash_to_sign).unwrap();
+        let proof = signature.as_bytes();
+
         create_session(CreateSessionParams {
             account_address: address,
             spec: session_spec.clone(),
@@ -208,6 +216,7 @@ mod tests {
             bundler_client: bundler_client.clone(),
             provider: provider.clone(),
             signer: signer.clone(),
+            proof: proof.into(),
         })
         .await?;
 
@@ -374,6 +383,13 @@ mod tests {
             }],
         };
 
+        let session_hash = hash_session(session_spec.clone());
+        let hash_to_sign =
+            keccak256((session_hash, account_address).abi_encode());
+        let signer_key = PrivateKeySigner::from_str(session_key_hex).unwrap();
+        let signature = signer_key.sign_hash_sync(&hash_to_sign).unwrap();
+        let proof = signature.as_bytes();
+
         create_session(CreateSessionParams {
             account_address,
             spec: session_spec.clone(),
@@ -383,6 +399,7 @@ mod tests {
             bundler_client: bundler_client.clone(),
             provider: provider.clone(),
             signer: eoa_signer.clone(),
+            proof: proof.into(),
         })
         .await?;
 
diff --git a/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-ffi-web/src/lib.rs b/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-ffi-web/src/lib.rs
index f69ae665..7a8519d4 100644
--- a/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-ffi-web/src/lib.rs
+++ b/packages/sdk-platforms/rust/zksync-sso-erc4337/crates/zksync-sso-erc4337-ffi-web/src/lib.rs
@@ -1685,6 +1685,7 @@ pub fn generate_session_stub_signature_wasm(
 #[wasm_bindgen]
 pub fn encode_create_session_call_data(
     session_spec_json: String,
+    proof: String,
 ) -> Result<String, JsValue> {
     // Parse SessionSpec from JSON
     let spec: SessionSpec =
@@ -1692,8 +1693,12 @@ pub fn encode_create_session_call_data(
             JsValue::from_str(&format!("Invalid SessionSpec JSON: {}", e))
         })?;
 
+    let proof_bytes = hex::decode(proof.trim_start_matches("0x"))
+        .map_err(|e| JsValue::from_str(&format!("Invalid proof hex: {}", e)))?;
+
     // Build createSession call and ABI encode
-    let create_session_calldata = create_session_call_data_core(spec);
+    let create_session_calldata =
+        create_session_call_data_core(spec, proof_bytes.into());
 
     Ok(format!("0x{}", hex::encode(create_session_calldata)))
 }