diff --git a/builtins/web/crypto/crypto-key.h b/builtins/web/crypto/crypto-key.h
index 8359f6c2..88db236d 100644
--- a/builtins/web/crypto/crypto-key.h
+++ b/builtins/web/crypto/crypto-key.h
@@ -59,7 +59,10 @@ class CryptoKeyUsages {
   [[nodiscard]] bool canOnlyDecrypt() const { return this->mask == decrypt_flag; };
   [[nodiscard]] bool canOnlySign() const { return this->mask == sign_flag; };
   [[nodiscard]] bool canOnlyVerify() const { return this->mask == verify_flag; };
-  [[nodiscard]] bool canOnlySignOrVerify() const { return (this->mask & (sign_flag | verify_flag)) != 0; };
+  [[nodiscard]] bool canOnlySignOrVerify() const {
+    return this->mask == sign_flag || this->mask == verify_flag ||
+           this->mask == (sign_flag | verify_flag);
+  };
   [[nodiscard]] bool canOnlyDeriveKey() const { return this->mask == derive_key_flag; };
   [[nodiscard]] bool canOnlyDeriveBits() const { return this->mask == derive_bits_flag; };
   [[nodiscard]] bool canOnlyWrapKey() const { return this->mask == wrap_key_flag; };
diff --git a/tests/integration/crypto/crypto.js b/tests/integration/crypto/crypto.js
index ca2aea06..20164b4a 100644
--- a/tests/integration/crypto/crypto.js
+++ b/tests/integration/crypto/crypto.js
@@ -1297,6 +1297,19 @@ export const handler = serveTest(async (t) => {
           deepStrictEqual(key.usages, ["sign", "verify"], `key.usages`);
         }
       });
+      await t.test("subtle.importKey.HMAC-non-sign-or-verify-usage", async () => {
+        for (const usages of [[], ["encrypt"], ["sign", "encrypt"], ["verify", "deriveBits"]]) {
+          await rejects(async () => {
+            await crypto.subtle.importKey(
+              "raw",
+              new Uint8Array([1, 0, 1]),
+              { name: "HMAC", hash: "SHA-256" },
+              false,
+              usages,
+            );
+          }, DOMException, undefined, "SyntaxError");
+        }
+      });
       await t.test("subtle.importKey.JWK-HS256-Public", async () => {
         const key = await crypto.subtle.importKey(
           "jwk",
diff --git a/tests/wpt-harness/expectations/WebCryptoAPI/import_export/okp_importKey_failures_Ed25519.https.any.js.json b/tests/wpt-harness/expectations/WebCryptoAPI/import_export/okp_importKey_failures_Ed25519.https.any.js.json
index b09ab922..19e96014 100644
--- a/tests/wpt-harness/expectations/WebCryptoAPI/import_export/okp_importKey_failures_Ed25519.https.any.js.json
+++ b/tests/wpt-harness/expectations/WebCryptoAPI/import_export/okp_importKey_failures_Ed25519.https.any.js.json
@@ -2136,16 +2136,16 @@
     "status": "PASS"
   },
   "Missing JWK 'kty' parameter: importKey(jwk(private), Ed25519, true, [sign])": {
-    "status": "FAIL"
+    "status": "PASS"
   },
   "Missing JWK 'kty' parameter: importKey(jwk(private), Ed25519, false, [sign])": {
-    "status": "FAIL"
+    "status": "PASS"
   },
   "Missing JWK 'kty' parameter: importKey(jwk(private), Ed25519, true, [sign, sign])": {
-    "status": "FAIL"
+    "status": "PASS"
   },
   "Missing JWK 'kty' parameter: importKey(jwk(private), Ed25519, false, [sign, sign])": {
-    "status": "FAIL"
+    "status": "PASS"
   },
   "Missing JWK 'crv' parameter: importKey(jwk (public) , Ed25519, true, [verify])": {
     "status": "PASS"
@@ -2172,16 +2172,16 @@
     "status": "PASS"
   },
   "Missing JWK 'kty' parameter: importKey(jwk(private), {name: Ed25519}, true, [sign])": {
-    "status": "FAIL"
+    "status": "PASS"
   },
   "Missing JWK 'kty' parameter: importKey(jwk(private), {name: Ed25519}, false, [sign])": {
-    "status": "FAIL"
+    "status": "PASS"
   },
   "Missing JWK 'kty' parameter: importKey(jwk(private), {name: Ed25519}, true, [sign, sign])": {
-    "status": "FAIL"
+    "status": "PASS"
   },
   "Missing JWK 'kty' parameter: importKey(jwk(private), {name: Ed25519}, false, [sign, sign])": {
-    "status": "FAIL"
+    "status": "PASS"
   },
   "Missing JWK 'crv' parameter: importKey(jwk (public) , {name: Ed25519}, true, [verify])": {
     "status": "PASS"