diff --git a/spec.bs b/spec.bs
index c419417f..40adc7df 100644
--- a/spec.bs
+++ b/spec.bs
@@ -3195,6 +3195,21 @@ The <dfn for=Navigator method>getInterestGroupAdAuctionData(|configIDL|)</dfn> m
 1. Let |p| be [=a new promise=].
 1. Let |queue| be the result of [=starting a new parallel queue=].
 1. [=parallel queue/enqueue steps|Enqueue the following steps=] to |queue|:
+  1. If |config|'s [=auction data config/coordinator=] is not one of the [=implementation-defined=]
+     coordinators supported by this [=user agent=]:
+     1. [=Queue a global task=] on the [=DOM manipulation task source=], given |global|, to
+        [=reject=] |p| with a {{TypeError}}.
+     1. Abort these steps.
+  1. Let |key| be a [=byte sequence=] containing one of the [[RFC9180|HPKE]] public
+     encryption keys for |config|'s [=auction data config/seller=] as determined
+     by |config|'s [=auction data config/coordinator=], or failure if no key is
+     available. The actual method for this lookup is [=implementation-defined=],
+     and may consist of fetching the keys from a known [=URL=].
+  1. If |key| is failure then:
+     1. [=Queue a global task=] on the [=DOM manipulation task source=], given |global|, to
+        [=reject=] |p| with a {{TypeError}}.
+     1. Abort these steps.
+  1. Set |config|'s [=auction data config/encryption key=] to |key|.
   1. Let |igMap| be a new [=map=] whose [=map/keys=] are [=origins=] and [=map/values=] are [=lists=].
   1. Let |startTime| be a [=moment=] equal to the [=current wall time=].
   1. [=list/For each=] |ig| of the [=user agent=]'s [=interest group set=]:
@@ -7657,6 +7672,9 @@ An <dfn>auction data config</dfn> is a [=struct=] with the following [=struct/it
   :  <dfn>coordinator</dfn>
   :: The origin of the coordinator hosting public encryption keys for the server
     running the ad auction. The [=origin/scheme=] must be "`https`".
+  :  <dfn>encryption key</dfn>
+  :: A [=byte sequence=]. The public [[RFC9180|HPKE]] encryption key to be used
+     to encrypt the request.
   :  <dfn>request size</dfn>
   :: {{unsigned long}} or null. An optional field, containing the desired size
     for the returned encrypted request blob.