diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 8e4b81f329..6a6c6d281a 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-401a9b3a27935fc5d6d81e829f6aa765f4ed8e24
+1a7e81206e8768722f0d0acfb3838036078e70be
diff --git a/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte b/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
index c2b8d2b7f6..bca71c8aee 100644
--- a/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
+++ b/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
@@ -191,13 +191,16 @@
 		const when =
 			days <= 0 ? 'has expired' : days === 1 ? 'expires tomorrow' : `expires in ${days} days`
 		if (credential.rotatable) {
-			// Renewal starts three weeks out, so a rotatable token this close to expiry
-			// means it has been failing silently and only a person can find out why.
-			if (days > 7) return undefined
+			// A token Windmill renews needs no countdown: a renewal that fails records
+			// an error, which is handled above. Reaching the expiry date anyway is the
+			// one state that proves renewal never happened, and it is the only one
+			// worth raising here — picking an earlier threshold would just be guessing
+			// at the server's renewal window from the client.
+			if (days > 0) return undefined
 			return {
-				type: days <= 0 ? ('error' as const) : ('warning' as const),
-				title: `Repository token ${when}`,
-				body: 'Windmill renews this token automatically but has not managed to. Check that the instance can reach GitLab, and replace the token if sync has already stopped.'
+				type: 'error' as const,
+				title: 'Repository token has expired',
+				body: 'Windmill renews this token automatically but has not managed to. Check that the instance can reach GitLab, then replace the token to restore sync.'
 			}
 		}
 		if (days > 30) return undefined