diff --git a/services/hermes/oauth2-proxy.yaml b/services/hermes/oauth2-proxy.yaml
index 668a4a196..b6554e300 100644
--- a/services/hermes/oauth2-proxy.yaml
+++ b/services/hermes/oauth2-proxy.yaml
@@ -22,7 +22,7 @@ data:
       <meta charset="utf-8">
       <meta name="viewport" content="width=device-width,initial-scale=1">
       <title>{{.StatusCode}} {{.Title}}</title>
-      {{if eq .StatusCode 500}}<meta http-equiv="refresh" content="0;url={{.ProxyPrefix}}/sign_in?rd=/">{{end}}
+      {{if or (eq .StatusCode 500) (eq .Message "Login Failed: Unable to find a valid CSRF token. Please try again.")}}<meta http-equiv="refresh" content="0;url={{.ProxyPrefix}}/sign_in?rd=/">{{end}}
       <style>
         body{margin:0;min-height:100vh;display:grid;place-items:center;background:#f5f5f5;color:#333;font:16px/1.5 system-ui,sans-serif}
         main{width:min(560px,calc(100% - 40px));box-sizing:border-box;padding:36px;border:1px solid #ddd;border-radius:14px;background:#fff;text-align:center;box-shadow:0 12px 45px #0002}
@@ -31,9 +31,9 @@ data:
     </head>
     <body>
       <main>
-        {{if eq .StatusCode 500}}
+        {{if or (eq .StatusCode 500) (eq .Message "Login Failed: Unable to find a valid CSRF token. Please try again.")}}
         <h1>Signing you back in…</h1>
-        <p class="detail">The previous one-time login callback was already used. Hermes is starting a fresh sign-in automatically.</p>
+        <p class="detail">The previous one-time login callback expired or was already used. Hermes is starting a fresh sign-in automatically.</p>
         <a href="{{.ProxyPrefix}}/sign_in?rd=/">Continue now</a>
         {{else}}
         <h1>{{.StatusCode}} {{.Title}}</h1>
@@ -276,7 +276,7 @@ spec:
       labels:
         app: oauth2-proxy-hermes-chat
       annotations:
-        ai.bstein.dev/config-rev: "20260809-consumed-callback-recovery"
+        ai.bstein.dev/config-rev: "20260809-expired-callback-recovery"
         vault.hashicorp.com/agent-inject: "true"
         vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/role: hermes-chat
diff --git a/testing/tests/test_hermes_chat_quality.py b/testing/tests/test_hermes_chat_quality.py
index 4db707679..2287f0eba 100644
--- a/testing/tests/test_hermes_chat_quality.py
+++ b/testing/tests/test_hermes_chat_quality.py
@@ -111,6 +111,8 @@ def test_chat_oauth_allows_stale_service_worker_retirement():
         and document["metadata"]["name"] == "hermes-chat-oauth-templates"
     )["data"]["error.html"]
     assert 'http-equiv="refresh"' in template
+    assert "Unable to find a valid CSRF token" in template
+    assert "expired or was already used" in template
     assert "/sign_in?rd=/" in template
 
 
