diff --git a/src/agent/credentials/default-credential-manager.ts b/src/agent/credentials/default-credential-manager.ts
index dc5f90e..2abf83e 100644
--- a/src/agent/credentials/default-credential-manager.ts
+++ b/src/agent/credentials/default-credential-manager.ts
@@ -177,7 +177,18 @@ export class DefaultAccountCredentialManager implements AccountCredentialManager
       };
     }
 
-    // Credentials expired — attempt refresh
+    // Credentials expired — attempt refresh if we have a refresh token
+    if (!credentials.refreshToken) {
+      log.warn({ configDir, accountId }, 'setup token expired, no refresh token available');
+      this.emitExpired(accountId, 'token_expired', 'Setup token expired, no refresh token available');
+      return {
+        valid: false,
+        credentials: null,
+        error: 'Setup token expired, no refresh token available',
+        refreshed: false,
+      };
+    }
+
     log.info({ configDir, accountId }, 'credentials expired, refreshing');
     const previousExpiresAt = credentials.expiresAt;
     const refreshed = await this.refresh(configDir, credentials.refreshToken);