diff --git a/frontend/components/account/__tests__/paymentShell.test.ts b/frontend/components/account/__tests__/paymentShell.test.ts
index 980ccd30..d5c5d6f3 100644
--- a/frontend/components/account/__tests__/paymentShell.test.ts
+++ b/frontend/components/account/__tests__/paymentShell.test.ts
@@ -78,6 +78,7 @@ export function runTests() {
   );
   assert(
     subscriptionsPageSource.includes("getSupabaseBrowserClient") &&
+      subscriptionsPageSource.includes("refreshSession") &&
       subscriptionsPageSource.includes("Authorization") &&
       subscriptionsPageSource.includes("/api/ops/subscriptions/grant") &&
       subscriptionsPageSource.includes("/api/ops/subscriptions/extend"),
diff --git a/frontend/components/ops/subscriptions/SubscriptionsPageClient.tsx b/frontend/components/ops/subscriptions/SubscriptionsPageClient.tsx
index 78dad82b..cf918c1d 100644
--- a/frontend/components/ops/subscriptions/SubscriptionsPageClient.tsx
+++ b/frontend/components/ops/subscriptions/SubscriptionsPageClient.tsx
@@ -15,9 +15,15 @@ async function buildOpsAuthHeaders() {
   };
   if (!hasSupabasePublicEnv()) return headers;
   try {
-    const {
+    const supabase = getSupabaseBrowserClient();
+    let {
       data: { session },
-    } = await getSupabaseBrowserClient().auth.getSession();
+    } = await supabase.auth.getSession();
+    const expiresAtMs = Number(session?.expires_at || 0) * 1000;
+    if (session && expiresAtMs > 0 && expiresAtMs - Date.now() < 60_000) {
+      const refreshed = await supabase.auth.refreshSession();
+      session = refreshed.data.session || session;
+    }
     const token = String(session?.access_token || "").trim();
     if (token) headers.Authorization = `Bearer ${token}`;
   } catch {