diff --git a/CHANGELOG.md b/CHANGELOG.md
index 56eb092..7f58040 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Fix signature counter to improve spec compliance:
   - Set the initial signature counter to 1.
+  - Correctly handle signature counter overflows by returning 0.
 
 ## [v0.4.0-rc.1](https://github.com/trussed-dev/fido-authenticator/releases/tag/v0.4.0-rc.1) (2026-05-29)
 
diff --git a/src/state.rs b/src/state.rs
index a10a7ef..480412d 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -397,8 +397,18 @@ impl PersistentState {
 
     pub fn signature_counter<T: FilesystemClient>(&mut self, trussed: &mut T) -> Result<u32> {
         let now = self.timestamp;
-        self.timestamp += 1;
-        self.save(trussed)?;
+        // 0 indicates a counter overflow. If this is the case, we can no longer increment the
+        // counter and have to always return 0, see Requirement 2.3.2 in the Security Requirements
+        // v1.5.
+        if now > 0 {
+            if let Some(timestamp) = self.timestamp.checked_add(1) {
+                self.timestamp = timestamp;
+            } else {
+                // Indicate an overflow by setting the counter to 0.
+                self.timestamp = 0;
+            }
+            self.save(trussed)?;
+        }
         Ok(now)
     }