diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 4b0d5970ee..6953108463 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -9,10 +9,26 @@ on:
     paths-ignore:
       - "**.md"
       - "tools/**"
+  pull_request_target:
+    paths-ignore:
+      - "**.md"
+      - "tools/**"
+    types:
+      - labeled
   schedule:
     - cron: 0 11 * * 1-5
 
 jobs:
+  unlabel:
+    if: ${{ github.event_name == 'pull_request_target' && github.event.label.name == 'full-ci' }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: gh pr edit $PR --repo $REPO --remove-label "full-ci"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR: ${{ github.event.number }}
+          REPO: ${{ github.event.repository.full_name }}
+
   build:
     runs-on: ubuntu-latest
     steps:
@@ -133,6 +149,7 @@ jobs:
 
   test-cloudflare:
     concurrency: test-cloudflare
+    if: ${{ !startsWith(github.event_name, 'pull_request') || (github.event_name == 'pull_request_target' && github.event.label.name == 'full-ci') }}
     needs:
       - build
 
@@ -217,7 +234,7 @@ jobs:
 
   test-browsers:
     concurrency: test-browsers
-    if: ${{ github.event_name != 'pull_request' }}
+    if: ${{ !startsWith(github.event_name, 'pull_request') || (github.event_name == 'pull_request_target' && github.event.label.name == 'full-ci') }}
     env:
       BROWSERSTACK_USERNAME: ${{ secrets.BROWSERSTACK_USERNAME }}
       BROWSERSTACK_ACCESS_KEY: ${{ secrets.BROWSERSTACK_ACCESS_KEY }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1605c7494a..29df572427 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [4.3.5](https://github.com/panva/jose/compare/v4.3.4...v4.3.5) (2021-11-12)
+
+
+### Fixes
+
+* **typescript:** b64 header regression ([#324](https://github.com/panva/jose/issues/324)) ([9da0a7f](https://github.com/panva/jose/commit/9da0a7f49cf763314748eb01303320ce5af69762))
+
 ## [4.3.4](https://github.com/panva/jose/compare/v4.3.3...v4.3.4) (2021-11-12)
 
 
diff --git a/dist/deno/README.md b/dist/deno/README.md
index 4959eeb235..d63062ed31 100644
--- a/dist/deno/README.md
+++ b/dist/deno/README.md
@@ -10,41 +10,41 @@ If you or your business use `jose`, please consider becoming a [sponsor][support
 
 **`example`** Deno import
 ```js
-import * as jose from 'https://deno.land/x/jose@v4.3.4/index.ts'
+import * as jose from 'https://deno.land/x/jose@v4.3.5/index.ts'
 ```
 
 - JSON Web Tokens (JWT)
-  - [Signing](https://github.com/panva/jose/blob/v4.3.4/docs/classes/jwt_sign.SignJWT.md#readme)
-  - [Verification & Claims Set Validation](https://github.com/panva/jose/blob/v4.3.4/docs/functions/jwt_verify.jwtVerify.md#readme)
+  - [Signing](https://github.com/panva/jose/blob/v4.3.5/docs/classes/jwt_sign.SignJWT.md#readme)
+  - [Verification & Claims Set Validation](https://github.com/panva/jose/blob/v4.3.5/docs/functions/jwt_verify.jwtVerify.md#readme)
   - Encrypted JSON Web Tokens
-    - [Encryption](https://github.com/panva/jose/blob/v4.3.4/docs/classes/jwt_encrypt.EncryptJWT.md#readme)
-    - [Decryption & Claims Set Validation](https://github.com/panva/jose/blob/v4.3.4/docs/functions/jwt_decrypt.jwtDecrypt.md#readme)
+    - [Encryption](https://github.com/panva/jose/blob/v4.3.5/docs/classes/jwt_encrypt.EncryptJWT.md#readme)
+    - [Decryption & Claims Set Validation](https://github.com/panva/jose/blob/v4.3.5/docs/functions/jwt_decrypt.jwtDecrypt.md#readme)
 - Key Import
-  - [JWK Import](https://github.com/panva/jose/blob/v4.3.4/docs/functions/key_import.importJWK.md#readme)
-  - [Public Key Import (SPKI)](https://github.com/panva/jose/blob/v4.3.4/docs/functions/key_import.importSPKI.md#readme)
-  - [Public Key Import (X.509 Certificate)](https://github.com/panva/jose/blob/v4.3.4/docs/functions/key_import.importX509.md#readme)
-  - [Private Key Import (PKCS #8)](https://github.com/panva/jose/blob/v4.3.4/docs/functions/key_import.importPKCS8.md#readme)
+  - [JWK Import](https://github.com/panva/jose/blob/v4.3.5/docs/functions/key_import.importJWK.md#readme)
+  - [Public Key Import (SPKI)](https://github.com/panva/jose/blob/v4.3.5/docs/functions/key_import.importSPKI.md#readme)
+  - [Public Key Import (X.509 Certificate)](https://github.com/panva/jose/blob/v4.3.5/docs/functions/key_import.importX509.md#readme)
+  - [Private Key Import (PKCS #8)](https://github.com/panva/jose/blob/v4.3.5/docs/functions/key_import.importPKCS8.md#readme)
 - JSON Web Encryption (JWE)
-  - Encryption - [Compact](https://github.com/panva/jose/blob/v4.3.4/docs/classes/jwe_compact_encrypt.CompactEncrypt.md#readme), [Flattened](https://github.com/panva/jose/blob/v4.3.4/docs/classes/jwe_flattened_encrypt.FlattenedEncrypt.md#readme), [General](https://github.com/panva/jose/blob/v4.3.4/docs/classes/jwe_general_encrypt.GeneralEncrypt.md#readme)
-  - Decryption - [Compact](https://github.com/panva/jose/blob/v4.3.4/docs/functions/jwe_compact_decrypt.compactDecrypt.md#readme), [Flattened](https://github.com/panva/jose/blob/v4.3.4/docs/functions/jwe_flattened_decrypt.flattenedDecrypt.md#readme), [General](https://github.com/panva/jose/blob/v4.3.4/docs/functions/jwe_general_decrypt.generalDecrypt.md#readme)
+  - Encryption - [Compact](https://github.com/panva/jose/blob/v4.3.5/docs/classes/jwe_compact_encrypt.CompactEncrypt.md#readme), [Flattened](https://github.com/panva/jose/blob/v4.3.5/docs/classes/jwe_flattened_encrypt.FlattenedEncrypt.md#readme), [General](https://github.com/panva/jose/blob/v4.3.5/docs/classes/jwe_general_encrypt.GeneralEncrypt.md#readme)
+  - Decryption - [Compact](https://github.com/panva/jose/blob/v4.3.5/docs/functions/jwe_compact_decrypt.compactDecrypt.md#readme), [Flattened](https://github.com/panva/jose/blob/v4.3.5/docs/functions/jwe_flattened_decrypt.flattenedDecrypt.md#readme), [General](https://github.com/panva/jose/blob/v4.3.5/docs/functions/jwe_general_decrypt.generalDecrypt.md#readme)
 - JSON Web Signature (JWS)
-  - Signing - [Compact](https://github.com/panva/jose/blob/v4.3.4/docs/classes/jws_compact_sign.CompactSign.md#readme), [Flattened](https://github.com/panva/jose/blob/v4.3.4/docs/classes/jws_flattened_sign.FlattenedSign.md#readme), [General](https://github.com/panva/jose/blob/v4.3.4/docs/classes/jws_general_sign.GeneralSign.md#readme)
-  - Verification - [Compact](https://github.com/panva/jose/blob/v4.3.4/docs/functions/jws_compact_verify.compactVerify.md#readme), [Flattened](https://github.com/panva/jose/blob/v4.3.4/docs/functions/jws_flattened_verify.flattenedVerify.md#readme), [General](https://github.com/panva/jose/blob/v4.3.4/docs/functions/jws_general_verify.generalVerify.md#readme)
+  - Signing - [Compact](https://github.com/panva/jose/blob/v4.3.5/docs/classes/jws_compact_sign.CompactSign.md#readme), [Flattened](https://github.com/panva/jose/blob/v4.3.5/docs/classes/jws_flattened_sign.FlattenedSign.md#readme), [General](https://github.com/panva/jose/blob/v4.3.5/docs/classes/jws_general_sign.GeneralSign.md#readme)
+  - Verification - [Compact](https://github.com/panva/jose/blob/v4.3.5/docs/functions/jws_compact_verify.compactVerify.md#readme), [Flattened](https://github.com/panva/jose/blob/v4.3.5/docs/functions/jws_flattened_verify.flattenedVerify.md#readme), [General](https://github.com/panva/jose/blob/v4.3.5/docs/functions/jws_general_verify.generalVerify.md#readme)
 - JSON Web Key (JWK)
-  - [Thumbprints](https://github.com/panva/jose/blob/v4.3.4/docs/functions/jwk_thumbprint.calculateJwkThumbprint.md#readme)
-  - [EmbeddedJWK](https://github.com/panva/jose/blob/v4.3.4/docs/functions/jwk_embedded.EmbeddedJWK.md#readme)
+  - [Thumbprints](https://github.com/panva/jose/blob/v4.3.5/docs/functions/jwk_thumbprint.calculateJwkThumbprint.md#readme)
+  - [EmbeddedJWK](https://github.com/panva/jose/blob/v4.3.5/docs/functions/jwk_embedded.EmbeddedJWK.md#readme)
 - JSON Web Key Set (JWKS)
-  - [Verify using a remote JWKSet](https://github.com/panva/jose/blob/v4.3.4/docs/functions/jwks_remote.createRemoteJWKSet.md#readme)
+  - [Verify using a remote JWKSet](https://github.com/panva/jose/blob/v4.3.5/docs/functions/jwks_remote.createRemoteJWKSet.md#readme)
 - Key Pair or Secret Generation
-  - [Asymmetric Key Pair Generation](https://github.com/panva/jose/blob/v4.3.4/docs/functions/key_generate_key_pair.generateKeyPair.md#readme)
-  - [Symmetric Secret Generation](https://github.com/panva/jose/blob/v4.3.4/docs/functions/key_generate_secret.generateSecret.md#readme)
+  - [Asymmetric Key Pair Generation](https://github.com/panva/jose/blob/v4.3.5/docs/functions/key_generate_key_pair.generateKeyPair.md#readme)
+  - [Symmetric Secret Generation](https://github.com/panva/jose/blob/v4.3.5/docs/functions/key_generate_secret.generateSecret.md#readme)
 - Key Export
-  - [JWK Export](https://github.com/panva/jose/blob/v4.3.4/docs/functions/key_export.exportJWK.md#readme)
-  - [Private Key Export](https://github.com/panva/jose/blob/v4.3.4/docs/functions/key_export.exportPKCS8.md#readme)
-  - [Public Key Export](https://github.com/panva/jose/blob/v4.3.4/docs/functions/key_export.exportSPKI.md#readme)
+  - [JWK Export](https://github.com/panva/jose/blob/v4.3.5/docs/functions/key_export.exportJWK.md#readme)
+  - [Private Key Export](https://github.com/panva/jose/blob/v4.3.5/docs/functions/key_export.exportPKCS8.md#readme)
+  - [Public Key Export](https://github.com/panva/jose/blob/v4.3.5/docs/functions/key_export.exportSPKI.md#readme)
 - Utilities
-  - [Decoding Token's Protected Header](https://github.com/panva/jose/blob/v4.3.4/docs/functions/util_decode_protected_header.decodeProtectedHeader.md#readme)
-- [Unsecured JWT](https://github.com/panva/jose/blob/v4.3.4/docs/classes/jwt_unsecured.UnsecuredJWT.md#readme)
-- [JOSE Errors](https://github.com/panva/jose/blob/v4.3.4/docs/modules/util_errors.md#readme)
+  - [Decoding Token's Protected Header](https://github.com/panva/jose/blob/v4.3.5/docs/functions/util_decode_protected_header.decodeProtectedHeader.md#readme)
+- [Unsecured JWT](https://github.com/panva/jose/blob/v4.3.5/docs/classes/jwt_unsecured.UnsecuredJWT.md#readme)
+- [JOSE Errors](https://github.com/panva/jose/blob/v4.3.5/docs/modules/util_errors.md#readme)
 
 [support-sponsor]: https://github.com/sponsors/panva
diff --git a/dist/deno/types.d.ts b/dist/deno/types.d.ts
index 188f53f39d..7e8ecbb168 100644
--- a/dist/deno/types.d.ts
+++ b/dist/deno/types.d.ts
@@ -734,7 +734,7 @@ export interface CompactJWSHeaderParameters extends JWSHeaderParameters {
  * may also be present.
  */
 export interface JWTHeaderParameters extends CompactJWSHeaderParameters {
-  b64: never
+  b64?: never
 }
 
 /**
diff --git a/dist/types/types.d.ts b/dist/types/types.d.ts
index 59c30d8ffb..f3d2a699d3 100644
--- a/dist/types/types.d.ts
+++ b/dist/types/types.d.ts
@@ -262,7 +262,7 @@ export interface CompactJWSHeaderParameters extends JWSHeaderParameters {
   alg: string
 }
 export interface JWTHeaderParameters extends CompactJWSHeaderParameters {
-  b64: never
+  b64?: never
 }
 export interface CompactJWEHeaderParameters extends JWEHeaderParameters {
   alg: string
diff --git a/docs/interfaces/types.JWTHeaderParameters.md b/docs/interfaces/types.JWTHeaderParameters.md
index 3d87f07ae1..2d207e4f92 100644
--- a/docs/interfaces/types.JWTHeaderParameters.md
+++ b/docs/interfaces/types.JWTHeaderParameters.md
@@ -31,7 +31,7 @@ ___
 
 ### b64
 
-• **b64**: `never`
+• `Optional` **b64**: `undefined`
 
 This JWS Extension Header Parameter modifies the JWS Payload
 representation and the JWS Signing Input computation as per
diff --git a/package.json b/package.json
index a113b63679..9f3450bfee 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "4.3.4",
+  "version": "4.3.5",
   "description": "'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto",
   "keywords": [
     "browser",
diff --git a/src/types.d.ts b/src/types.d.ts
index 188f53f39d..7e8ecbb168 100644
--- a/src/types.d.ts
+++ b/src/types.d.ts
@@ -734,7 +734,7 @@ export interface CompactJWSHeaderParameters extends JWSHeaderParameters {
  * may also be present.
  */
 export interface JWTHeaderParameters extends CompactJWSHeaderParameters {
-  b64: never
+  b64?: never
 }
 
 /**