@@ -20,9 +20,18 @@
 
 ### Fixed
 
-- OAuth sign-in now works on deployments that enforce token scopes. Users signed
-  in with OAuth are asked to sign in again once.
-- Revoke OAuth tokens on logout even when their scopes are outdated.
+- OAuth sign-in now works on deployments that enforce token scopes. Sessions
+  missing required scopes stop refreshing and require sign-in when they expire.
+- Revoke OAuth tokens on logout and after successful session replacement, even
+  when their scopes are outdated. Failed or canceled sign-ins do not revoke
+  the stored session.
+- Preserve OAuth refresh credentials when reusing a stored token, and request
+  the permissions needed to refresh workspace external-auth links.
+- If a deployment disables dynamic client registration (the default from Coder
+  2.38), OAuth sign-in now names the setting and offers session-token sign-in.
+- CLI commands and SSH connections that the extension starts ignore
+  `CODER_SESSION_TOKEN` from the environment, so they no longer fail or run as a
+  different user inside a Coder workspace.
 
 ## [v1.16.4](https://github.com/coder/vscode-coder/releases/tag/v1.16.4) 2026-09-23
 
 
@@ -102,7 +102,7 @@ export class AuthInterceptor implements vscode.Disposable {
 
 			// 1) OAuth refresh path.
 			const isOAuth =
-				await this.oauthSessionManager.isLoggedInWithOAuth(hostname);
+				await this.oauthSessionManager.canRefreshOAuthSession(hostname);
 			recorder.setRefreshAttempted(isOAuth);
 			if (isOAuth) {
 				const newToken = await this.tryOAuthRefresh();
 
@@ -14,6 +14,7 @@ import {
 import { recordError } from "../instrumentation/outcomes";
 import {
 	type CliAuth,
+	EMPTY_TOKEN_FLAG,
 	getGlobalFlags,
 	mayUseCliStore,
 	resolveCliAuth,
@@ -75,10 +76,16 @@ export class CliCredentialManager {
 				return;
 			}
 			span.setProperty("store", cli.auth.store);
-			await this.exec(cli, ["login", "--use-token-as-session", url], {
-				env: { ...process.env, CODER_SESSION_TOKEN: token },
-				signal: options?.signal,
-			});
+			// `login` reads the token from the environment, which the empty flag would hide.
+			const flags = cli.flags.filter((flag) => flag !== EMPTY_TOKEN_FLAG);
+			await this.exec(
+				{ ...cli, flags },
+				["login", "--use-token-as-session", url],
+				{
+					env: envWithSessionToken(token),
+					signal: options?.signal,
+				},
+			);
 			span.setProperty("outcome", "stored");
 			this.logger.info("Stored token via CLI for", url);
 		});
@@ -268,3 +275,13 @@ export class CliCredentialManager {
 		return results.every(Boolean);
 	}
 }
+
+/** `process.env` with `token` as the only session token, since the CLI reads the name in any case. */
+function envWithSessionToken(token: string): NodeJS.ProcessEnv {
+	const env = Object.fromEntries(
+		Object.entries(process.env).filter(
+			([key]) => key.toUpperCase() !== "CODER_SESSION_TOKEN",
+		),
+	);
+	return { ...env, CODER_SESSION_TOKEN: token };
+}
@@ -7,15 +7,22 @@ import { needToken } from "../api/httpAgent";
 import { HttpStatusCode } from "../api/httpStatusCode";
 import { isSameOrigin, openInBrowser } from "../common/url";
 import { CertificateError } from "../error/certificateError";
-import { OAuthAuthorizer } from "../oauth/authorizer";
+import {
+	ClientRegistrationDisabledError,
+	OAuthAuthorizer,
+} from "../oauth/authorizer";
+import { revokeOAuthTokens } from "../oauth/revocation";
 import { buildOAuthTokenData } from "../oauth/tokens";
 import { withCancellableProgress } from "../ui/progress";
 import { maybeAskAuthMethod, maybeAskUrl } from "../ui/prompts";
 import { vscodeProposed } from "../vscode/proposed";
 
 import { showStoreCredentialsError } from "./credentials";
 
-import type { User } from "coder/site/src/api/typesGenerated";
+import type {
+	User,
+	OAuth2ClientRegistrationResponse,
+} from "coder/site/src/api/typesGenerated";
 
 import type { CliCredentialManager } from "../cli/cliCredentialManager";
 import type { Deployment } from "../deployment/types";
@@ -109,18 +116,14 @@ export class LoginCoordinator implements vscode.Disposable {
 		options: LoginOptions & { url: string },
 	): Promise<LoginResult> {
 		const { safeHostname, url } = options;
-		return this.executeWithGuard(async () => {
-			const result = await this.attemptLogin(
+		return this.executeWithGuard(() =>
+			this.attemptLogin(
 				{ safeHostname, url },
 				options.autoLogin ?? false,
 				options.token,
 				options.tokenSignInConfirmed ?? false,
-			);
-
-			await this.persistSessionAuth(result, safeHostname, url);
-
-			return result;
-		});
+			),
+		);
 	}
 
 	/**
@@ -170,15 +173,11 @@ export class LoginCoordinator implements vscode.Disposable {
 							return { success: false, reason: "no_url_provided" };
 						}
 
-						const result = await this.attemptLogin(
+						return this.attemptLogin(
 							{ url: newUrl, safeHostname },
 							false,
 							options.token,
 						);
-
-						await this.persistSessionAuth(result, safeHostname, newUrl);
-
-						return result;
 					}
 					// User cancelled
 					return { success: false, reason: "user_dismissed" };
@@ -198,28 +197,42 @@ export class LoginCoordinator implements vscode.Disposable {
 	}
 
 	private async persistSessionAuth(
-		result: LoginResult,
-		safeHostname: string,
-		url: string,
+		result: Extract<LoginResult, { success: true }>,
+		deployment: Deployment,
+		registration: OAuth2ClientRegistrationResponse | undefined,
 	): Promise<void> {
+		const { safeHostname, url } = deployment;
+		const previous = await this.secretsManager.getSessionAuth(safeHostname);
+		const replaced = previous?.token === result.token ? undefined : previous;
+		// A refresh rotated the stored session while this login checked it.
+		if (result.method === "stored_token" && replaced) {
+			return;
+		}
+		const reusedOAuth =
+			!replaced && previous && isSameOrigin(previous.url, url)
+				? previous.oauth
+				: undefined;
+
 		// Empty token is valid for mTLS
-		if (result.success) {
-			await this.secretsManager.setSessionAuth(safeHostname, {
-				url,
-				token: result.token,
-				username: result.user.username,
-				oauth: result.oauth, // undefined for non-OAuth logins
-			});
-			await this.mementoManager.addToUrlHistory(url);
-
-			if (result.token) {
-				const configs = vscode.workspace.getConfiguration();
-				this.cliCredentialManager
-					.storeToken(url, result.token, configs)
-					.catch((error) =>
-						showStoreCredentialsError(error, configs, this.logger),
-					);
-			}
+		await this.secretsManager.setSessionAuth(safeHostname, {
+			url,
+			token: result.token,
+			username: result.user.username,
+			oauth: result.oauth ?? reusedOAuth,
+		});
+		await this.mementoManager.addToUrlHistory(url);
+
+		if (replaced?.oauth) {
+			void revokeOAuthTokens(replaced, registration, this.logger);
+		}
+
+		if (result.token) {
+			const configs = vscode.workspace.getConfiguration();
+			this.cliCredentialManager
+				.storeToken(url, result.token, configs)
+				.catch((error) =>
+					showStoreCredentialsError(error, configs, this.logger),
+				);
 		}
 	}
 
@@ -286,15 +299,23 @@ export class LoginCoordinator implements vscode.Disposable {
 		providedToken?: string,
 		tokenSignInConfirmed = false,
 	): Promise<LoginResult> {
+		// Read before an OAuth login can re-register the client.
+		const registration = await this.secretsManager.getOAuthClientRegistration(
+			deployment.safeHostname,
+		);
 		const client = CoderApi.create(deployment.url, "", this.logger);
 		try {
-			return await this.runLoginAttempts(
+			const result = await this.runLoginAttempts(
 				client,
 				deployment,
 				isAutoLogin,
 				providedToken,
 				tokenSignInConfirmed,
 			);
+			if (result.success) {
+				await this.persistSessionAuth(result, deployment, registration);
+			}
+			return result;
 		} finally {
 			client.dispose();
 		}
@@ -477,11 +498,16 @@ export class LoginCoordinator implements vscode.Disposable {
 	private async askAuthMethod(ctx: LoginAttemptContext): Promise<LoginResult> {
 		const authMethod = await maybeAskAuthMethod(ctx.client);
 		switch (authMethod) {
-			case "oauth":
+			case "oauth": {
+				const result = await this.loginWithOAuth(ctx.deployment);
+				if (result !== "use_token") {
+					return withLoginMethod("oauth", result);
+				}
 				return withLoginMethod(
-					"oauth",
-					await this.loginWithOAuth(ctx.deployment),
+					"cli_token",
+					await this.loginWithToken(ctx.client),
 				);
+			}
 			case "legacy":
 				return withLoginMethod(
 					"cli_token",
@@ -636,12 +662,10 @@ export class LoginCoordinator implements vscode.Disposable {
 		return { success: false, reason: "user_dismissed" };
 	}
 
-	/**
-	 * OAuth authentication flow.
-	 */
+	/** OAuth flow; "use_token" means the user chose session-token sign-in instead. */
 	private async loginWithOAuth(
 		deployment: Deployment,
-	): Promise<LoginAttemptResult> {
+	): Promise<LoginAttemptResult | "use_token"> {
 		try {
 			this.logger.debug("Starting OAuth authentication");
 
@@ -666,6 +690,21 @@ export class LoginCoordinator implements vscode.Disposable {
 				oauth: buildOAuthTokenData(tokenResponse),
 			};
 		} catch (error) {
+			if (error instanceof ClientRegistrationDisabledError) {
+				this.logger.warn("OAuth sign-in unavailable:", error.message);
+				const action = await vscodeProposed.window.showWarningMessage(
+					"OAuth sign-in is unavailable",
+					{
+						useCustom: true,
+						modal: true,
+						detail: `${error.message}. To use OAuth, ask an administrator to set dynamic_client_registration_enabled.`,
+					},
+					"Sign In with Token",
+				);
+				return action === "Sign In with Token"
+					? "use_token"
+					: { success: false, reason: "user_dismissed" };
+			}
 			const title = "OAuth authentication failed";
 			this.logger.error(title, error);
 			if (error instanceof CertificateError) {
 
@@ -1,7 +1,9 @@
+import { type AxiosInstance, isAxiosError } from "axios";
 import { createHash, randomBytes } from "node:crypto";
 import * as vscode from "vscode";
 
 import { CoderApi } from "../api/coderApi";
+import { HttpStatusCode } from "../api/httpStatusCode";
 import { resolveCoderDashboardUrl } from "../common/url";
 
 import {
@@ -21,7 +23,6 @@ import {
 	parseOAuthResponse,
 } from "./validation";
 
-import type { AxiosInstance } from "axios";
 import type {
 	OAuth2AuthorizationServerMetadata,
 	OAuth2ClientRegistrationRequest,
@@ -37,6 +38,14 @@ import type { SecretsManager } from "../storage/secretsManager";
 
 import type { OAuthCallback } from "./oauthCallback";
 
+/** The server refuses client registration, which is off by default from Coder 2.38. */
+export class ClientRegistrationDisabledError extends Error {
+	constructor() {
+		super("Dynamic client registration is disabled on this deployment");
+		this.name = "ClientRegistrationDisabledError";
+	}
+}
+
 /**
  * Handles the OAuth authorization code flow for authenticating with Coder deployments.
  * Encapsulates client registration, PKCE challenge, and token exchange.
@@ -171,10 +180,20 @@ export class OAuthAuthorizer implements vscode.Disposable {
 			token_endpoint_auth_method: TOKEN_ENDPOINT_AUTH_METHOD,
 		};
 
-		const response = await axiosInstance.post<OAuth2ClientRegistrationResponse>(
-			metadata.registration_endpoint,
-			registrationRequest,
-		);
+		const response = await axiosInstance
+			.post<OAuth2ClientRegistrationResponse>(
+				metadata.registration_endpoint,
+				registrationRequest,
+			)
+			.catch((error: unknown) => {
+				if (
+					isAxiosError(error) &&
+					error.response?.status === HttpStatusCode.FORBIDDEN
+				) {
+					throw new ClientRegistrationDisabledError();
+				}
+				throw error;
+			});
 
 		const registrationResponse = parseOAuthResponse(
 			OAuth2ClientRegistrationResponseSchema,
 
@@ -3,15 +3,16 @@ export const AUTH_GRANT_TYPE = "authorization_code";
 export const REFRESH_GRANT_TYPE = "refresh_token";
 
 /**
- * Scopes the extension and the CLI need. Stored sessions must have all of
- * them, so adding one signs out users of servers that enforce scopes.
+ * Scopes the extension and the CLI need. Sessions missing one stop refreshing,
+ * so on servers that enforce scopes, adding one means signing in at expiry.
  */
 export const DEFAULT_OAUTH_SCOPES = [
 	"coder:workspaces.operate",
 	"coder:workspaces.access",
 	"workspace:create",
 	"user:read",
 	"user:read_personal",
+	"user:update_personal",
 ].join(" ");
 
 /**
 
@@ -1,3 +1,4 @@
+import { CoderApi } from "../api/coderApi";
 import { parseApiResponse } from "../api/responseValidation";
 
 import {
@@ -142,6 +143,33 @@ export class OAuthMetadataClient {
 	}
 }
 
+/**
+ * Run `fn` with a short-lived client for `url` and the server's OAuth
+ * metadata. The client is disposed on exit so its config-change
+ * subscriptions never outlive the operation.
+ */
+export async function withOAuthMetadata<T>(
+	url: string,
+	token: string | undefined,
+	logger: Logger,
+	fn: (ctx: {
+		axiosInstance: AxiosInstance;
+		metadata: OAuth2AuthorizationServerMetadata;
+	}) => Promise<T>,
+): Promise<T> {
+	const client = CoderApi.create(url, token, logger);
+	try {
+		const axiosInstance = client.getAxiosInstance();
+		const metadata = await new OAuthMetadataClient(
+			axiosInstance,
+			logger,
+		).getMetadata();
+		return await fn({ axiosInstance, metadata });
+	} finally {
+		client.dispose();
+	}
+}
+
 /**
  * Check if an array includes all required types.
  */