How should I disambiguate JWTs from different sources?

I can't use the key ID (kid) from the JWT header, because it's perfectly fine for the same issuer to use the same key for two environments (not that they should, but they technically could).

I could use the issuer (iss) from the JWT claims payload (before verification, ew, but I have no choice). But the problem is that I don't know the issuer until I fetch the Open ID configuration. I prefer not to depend on an external resource on this code path (which gets called for every request).

Maybe I can use the client ID? This is configuration in our own application, not an external one. Looking at some JWTs, there's the "client_id" field in JWT claims payload. I don't think that's standard though.