@@ -20,6 +20,7 @@
 
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.io.BaseEncoding;
+import com.google.common.io.ByteStreams;
 import com.google.gson.JsonElement;
 import com.google.gson.JsonObject;
 import com.google.gson.JsonParser;
@@ -45,15 +46,17 @@
  * parses it to extract its expiration time, and caches/refreshes it.
  */
 public final class JwtTokenFileCallCredentials extends CallCredentials {
+  private static final int MAX_FILE_SIZE_BYTES = 1048576;
 
   private static final Logger log = Logger.getLogger(JwtTokenFileCallCredentials.class.getName());
 
   private static final Metadata.Key<String> AUTHORIZATION_HEADER =
       Metadata.Key.of("authorization", Metadata.ASCII_STRING_MARSHALLER);
 
-  private static final long INITIAL_BACKOFF_MS = 1000;
-  private static final long MAX_BACKOFF_MS = 60000;
-  private static final double BACKOFF_MULTIPLIER = 2.0;
+  private static final long INITIAL_BACKOFF_MILLIS = 1000;
+  private static final long MAX_BACKOFF_MILLIS = 120000;
+  private static final double BACKOFF_MULTIPLIER = 1.6;
+  private static final double JITTER = 0.2;
 
   private final String filePath;
   private final TimeProvider timeProvider;
@@ -69,7 +72,7 @@ private enum ReadState {
   private long expirationTimeMillis;
   private ReadState readState = ReadState.IDLE;
   private Status lastReadFailureStatus;
-  private long currentBackoffMs;
+  private long currentBackoffMillis;
   private long nextAttemptTimeMillis;
   private final List<MetadataApplier> queuedAppliers = new ArrayList<>();
 
@@ -122,11 +125,17 @@ public void applyRequestMetadata(
 
       if (hasValidCache) {
         tokenToApply = new TokenInfo(cachedToken, expirationTimeMillis);
+        if (readState == ReadState.BACKOFF && now >= nextAttemptTimeMillis) {
+          readState = ReadState.IDLE;
+        }
         if (expiringSoon && readState == ReadState.IDLE) {
           readState = ReadState.READING;
           triggerRead = true;
         }
       } else {
+        if (readState == ReadState.BACKOFF && now >= nextAttemptTimeMillis) {
+          readState = ReadState.IDLE;
+        }
         if (readState == ReadState.BACKOFF) {
           failStatus = lastReadFailureStatus != null ? lastReadFailureStatus : Status.UNAVAILABLE;
         } else {
@@ -214,7 +223,7 @@ private void loadToken() {
         expirationTimeMillis = tokenInfo.expirationTimeMillis;
         readState = ReadState.IDLE;
         lastReadFailureStatus = null;
-        currentBackoffMs = 0;
+        currentBackoffMillis = 0;
         nextAttemptTimeMillis = 0;
 
         appliersToApply.addAll(queuedAppliers);
@@ -223,13 +232,16 @@ private void loadToken() {
         lastReadFailureStatus = status;
         readState = ReadState.BACKOFF;
 
-        if (currentBackoffMs == 0) {
-          currentBackoffMs = INITIAL_BACKOFF_MS;
+        if (currentBackoffMillis == 0) {
+          currentBackoffMillis = INITIAL_BACKOFF_MILLIS;
         } else {
-          currentBackoffMs = Math.min(
-              (long) (currentBackoffMs * BACKOFF_MULTIPLIER), MAX_BACKOFF_MS);
+          currentBackoffMillis = Math.min(
+              (long) (currentBackoffMillis * BACKOFF_MULTIPLIER), MAX_BACKOFF_MILLIS);
         }
-        nextAttemptTimeMillis = timeProvider.currentTimeMillis() + currentBackoffMs;
+        double uniformRandom = Math.random() * 2 - 1;
+        long jitteredBackoff = (long) (currentBackoffMillis
+            + uniformRandom * JITTER * currentBackoffMillis);
+        nextAttemptTimeMillis = timeProvider.currentTimeMillis() + jitteredBackoff;
 
         appliersToFail.addAll(queuedAppliers);
         queuedAppliers.clear();
@@ -261,15 +273,15 @@ private void loadToken() {
   private TokenInfo readAndParseTokenFile() throws IOException {
     File file = new File(filePath);
     long length = file.length();
-    if (length > 1048576) {
+    if (length > MAX_FILE_SIZE_BYTES) {
       throw new IOException("File size exceeds 1 MB limit: " + length);
     }
     byte[] bytes;
     try (InputStream in = new FileInputStream(file)) {
-      bytes = com.google.common.io.ByteStreams.toByteArray(
-          com.google.common.io.ByteStreams.limit(in, 1048577));
+      bytes = ByteStreams.toByteArray(
+          ByteStreams.limit(in, MAX_FILE_SIZE_BYTES + 1));
     }
-    if (bytes.length > 1048576) {
+    if (bytes.length > MAX_FILE_SIZE_BYTES) {
       throw new IOException("File size exceeds 1 MB limit: " + bytes.length);
     }
     String token = new String(bytes, StandardCharsets.UTF_8).trim();
 
@@ -284,7 +284,7 @@ public void applyMetadata_fileReadError_backoff() throws Exception {
     assertEquals(0, executor.runnables.size());
 
     // 3. Move time past backoff limit (t=11001)
-    timeProvider.set(11001);
+    timeProvider.set(15000);
     MetadataApplier applier3 = Mockito.mock(MetadataApplier.class);
     credentials.applyRequestMetadata(requestInfo, executor, applier3);
     // Should NOT fail fast. Instead, it should trigger a new attempt.
@@ -604,4 +604,49 @@ public void applyMetadata_fileContentTooLarge_failsUnavailable() throws Exceptio
     assertTrue(status.getDescription().contains("Failed to read token file"));
     assertTrue(status.getCause().getMessage().contains("File size exceeds 1 MB limit"));
   }
+
+  @Test
+  public void emptyTokenFileThrowsIllegalArgumentException() throws Exception {
+    File emptyFile = File.createTempFile("emptyToken", ".jwt", tempFolder.getRoot());
+    emptyFile.deleteOnExit();
+
+    JwtTokenFileCallCredentials credentials =
+        new JwtTokenFileCallCredentials(emptyFile.getAbsolutePath(), timeProvider);
+
+    RequestInfoImpl requestInfo = new RequestInfoImpl(SecurityLevel.PRIVACY_AND_INTEGRITY);
+    credentials.applyRequestMetadata(requestInfo, executor, applier1);
+    assertEquals(1, executor.runnables.size());
+    executor.runNext();
+
+    verify(applier1).fail(statusCaptor.capture());
+    Status status = statusCaptor.getValue();
+    assertEquals(Status.Code.UNAUTHENTICATED, status.getCode());
+    assertTrue(status.getCause() instanceof IllegalArgumentException);
+  }
+
+  @Test
+  public void largeExpClaimClampsToLongMaxValue() throws Exception {
+    String header = "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0"; // {"alg":"none","typ":"JWT"}
+    String payload = "eyJleHAiOjk5OTk5OTk5OTk5OTk5OTl9"; // {"exp":9999999999999999}
+    String token = header + "." + payload + ".";
+    
+    File tokenFile = File.createTempFile("largeExpToken", ".jwt", tempFolder.getRoot());
+    tokenFile.deleteOnExit();
+    java.nio.file.Files.write(tokenFile.toPath(),
+        token.getBytes(java.nio.charset.StandardCharsets.UTF_8));
+
+    timeProvider.currentTimeMillis = 0;
+    JwtTokenFileCallCredentials credentials =
+        new JwtTokenFileCallCredentials(tokenFile.getAbsolutePath(), timeProvider);
+
+    RequestInfoImpl requestInfo = new RequestInfoImpl(SecurityLevel.PRIVACY_AND_INTEGRITY);
+    credentials.applyRequestMetadata(requestInfo, executor, applier1);
+    assertEquals(1, executor.runnables.size());
+    executor.runNext();
+
+    verify(applier1).apply(any(io.grpc.Metadata.class));
+    // The credentials logic doesn't easily expose the clamped value directly to this test without 
+    // waiting or mocking, but it prevents overflow crash
+    // and parses successfully instead of returning an error.
+  }
 }
@@ -24,6 +24,7 @@
 
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.Iterables;
+import io.grpc.CallCredentials;
 import io.grpc.InsecureChannelCredentials;
 import io.grpc.TlsChannelCredentials;
 import io.grpc.auth.JwtTokenFileCallCredentials;
@@ -1252,4 +1253,65 @@ public void parseBootstrap_malformedCallCreds_throws() throws Exception {
       setEnableXdsBootstrapCallCreds(false);
     }
   }
+
+  @Test
+  public void parseBootstrap_xdsServers_multipleValidCallCreds() throws Exception {
+    setEnableXdsBootstrapCallCreds(true);
+    try {
+      String rawData = "{\n"
+          + "  \"xds_servers\": [\n"
+          + "    {\n"
+          + "      \"server_uri\": \"" + SERVER_URI + "\",\n"
+          + "      \"channel_creds\": [{\"type\": \"insecure\"}],\n"
+          + "      \"call_creds\": [\n"
+          + "        {\n"
+          + "          \"type\": \"jwt_token_file\",\n"
+          + "          \"config\": { \"jwt_token_file\": \"/var/run/secrets/token1\" }\n"
+          + "        },\n"
+          + "        {\n"
+          + "          \"type\": \"jwt_token_file\",\n"
+          + "          \"config\": { \"jwt_token_file\": \"/var/run/secrets/token2\" }\n"
+          + "        }\n"
+          + "      ]\n"
+          + "    }\n"
+          + "  ]\n"
+          + "}";
+      bootstrapper.setFileReader(createFileReader(BOOTSTRAP_FILE_PATH, rawData));
+      BootstrapInfo info = bootstrapper.bootstrap();
+      assertThat(info.servers()).hasSize(1);
+      ServerInfo serverInfo = info.servers().get(0);
+      CallCredentials creds = serverInfo.callCredentials();
+      assertThat(creds).isNotNull();
+      assertThat(creds).isInstanceOf(io.grpc.CompositeCallCredentials.class);
+    } finally {
+      setEnableXdsBootstrapCallCreds(false);
+    }
+  }
+
+  @Test
+  public void parseBootstrap_xdsServers_missingTypeCallCreds() throws Exception {
+    setEnableXdsBootstrapCallCreds(true);
+    try {
+      String rawData = "{\n"
+          + "  \"xds_servers\": [\n"
+          + "    {\n"
+          + "      \"server_uri\": \"" + SERVER_URI + "\",\n"
+          + "      \"channel_creds\": [{\"type\": \"insecure\"}],\n"
+          + "      \"call_creds\": [\n"
+          + "        {\n"
+          + "          \"config\": { \"jwt_token_file\": \"/var/run/secrets/token\" }\n"
+          + "        }\n"
+          + "      ]\n"
+          + "    }\n"
+          + "  ]\n"
+          + "}";
+      bootstrapper.setFileReader(createFileReader(BOOTSTRAP_FILE_PATH, rawData));
+      bootstrapper.bootstrap();
+      fail("Expected exception");
+    } catch (XdsInitializationException e) {
+      assertThat(e).hasMessageThat().contains("with 'call_creds' type unspecified");
+    } finally {
+      setEnableXdsBootstrapCallCreds(false);
+    }
+  }
 }