diff --git a/cloud/apps/sandbox-control/src/agent-credential-checks.ts b/cloud/apps/sandbox-control/src/agent-credential-checks.ts
index 113c421be52..08f7d6cd50a 100644
--- a/cloud/apps/sandbox-control/src/agent-credential-checks.ts
+++ b/cloud/apps/sandbox-control/src/agent-credential-checks.ts
@@ -111,8 +111,10 @@ async function checkCredential(
 export async function handleAccountUnauthorized(
   ctx: CheckContext & { sandboxId: string; path: string }
 ): Promise<CheckOutcome> {
+  // The 401 that triggered the failed check was consumed by that check, so any 401 seen here, with the
+  // sign-in already in question, is a different, later real request.
   const suspectAt = await agentCredentialSuspectAt(ctx.db, ctx.userId, ctx.provider.agent)
-  if (suspectAt !== null && ctx.now > suspectAt) {
+  if (suspectAt !== null) {
     await markAgentCredentialRevoked(ctx.db, ctx.userId, ctx.provider.agent, ctx.now)
     await audit(ctx.db, {
       userId: ctx.userId,