diff --git a/src/main/rate-limits/grok-fetcher.test.ts b/src/main/rate-limits/grok-fetcher.test.ts
index f816d5c552f..07c536f32a0 100644
--- a/src/main/rate-limits/grok-fetcher.test.ts
+++ b/src/main/rate-limits/grok-fetcher.test.ts
@@ -159,6 +159,10 @@ describe('fetchGrokRateLimits', () => {
     const result = await fetchGrokRateLimits()
     expect(result.status).toBe('error')
     expect(result.error).toMatch(/expired/i)
+    // Why: a stored-but-expired access token is refreshed by Grok CLI on next
+    // use (a genuine sign-out returns 'missing'), so the message must not tell
+    // users to re-run `grok login` (#8497).
+    expect(result.error).not.toMatch(/grok login/i)
     expect(netFetchMock).not.toHaveBeenCalled()
   })
 })
diff --git a/src/main/rate-limits/grok-fetcher.ts b/src/main/rate-limits/grok-fetcher.ts
index 963a2fb1350..099298a56c4 100644
--- a/src/main/rate-limits/grok-fetcher.ts
+++ b/src/main/rate-limits/grok-fetcher.ts
@@ -145,7 +145,10 @@ export async function fetchGrokRateLimits(
   }
   const session = readResult.session
   if (!isGrokAccessTokenFresh(session)) {
-    return result('error', 'Grok session expired — run grok login to refresh')
+    // Why: a genuine sign-out returns 'missing' earlier, so reaching here always
+    // means a stored, refreshable session — Grok CLI refreshes the access token
+    // on its next run, so don't tell users to re-run `grok login` (#8497).
+    return result('error', 'Grok access token expired — Grok CLI will refresh it on next use')
   }
 
   try {
diff --git a/src/renderer/src/components/status-bar/tooltip.test.ts b/src/renderer/src/components/status-bar/tooltip.test.ts
index c553f68ddb1..d9387633fa0 100644
--- a/src/renderer/src/components/status-bar/tooltip.test.ts
+++ b/src/renderer/src/components/status-bar/tooltip.test.ts
@@ -135,6 +135,21 @@ describe('provider usage error copy', () => {
     )
   })
 
+  it('keeps the reworded Grok expired-token error classified as an auth failure (#8497)', () => {
+    // Why: the fix (grok-fetcher.ts) dropped the "run grok login" wording that
+    // used to trigger auth classification; this pins that the new copy still
+    // resolves to the softer refresh message instead of leaking the raw string.
+    const grok = provider({
+      provider: 'grok',
+      error: 'Grok access token expired — Grok CLI will refresh it on next use'
+    })
+
+    expect(getProviderUsageStatusLabel(grok)).toBe('Refresh failed')
+    expect(getProviderUsageErrorMessage(grok)).toBe(
+      'Grok usage could not be refreshed. Agent sessions may still be signed in.'
+    )
+  })
+
   it('frames known Codex auth refresh failures as auth-shaped usage failures', () => {
     const cases = [
       'Please reauthenticate before checking usage.',