@@ -204,19 +204,40 @@ func (m *Manager) SessionAccessToken(ctx context.Context, id, label string) (str
 	token, hold, err := m.mintAgentToken(ctx, mint)
 	if err != nil {
 		if hold != nil {
-			lockErr := m.store.withKeyLock(ctx, credKey, func() error {
-				m.rememberRenewalHold(credKey, hold)
-				return nil
-			})
-			if lockErr != nil {
-				m.warnf("warning: could not lock the credential for %s to remember the token endpoint's refusal, so the next command will ask again: %v", credKey, lockErr)
-			}
+			err = m.rememberSessionHold(ctx, credKey, hold, err)
 		}
 		return "", forSession(launch, m.hintLogin(err))
 	}
 	return token.AccessToken, nil
 }
 
+// rememberSessionHold writes the hold a session mint's refusal leaves, under
+// the credential lock, and returns what the mint answers with: its own
+// refusal, or the verdict that stood instead.
+//
+// With no lock across the round trip, another launch's verdict on the same
+// secret can land while this mint is in flight, and one that outlasts this
+// mint's stands (rememberRenewalHold). Its answer is then this mint's too,
+// so the wait a caller is told is the one the next mint will meet.
+func (m *Manager) rememberSessionHold(ctx context.Context, credKey string, hold *RenewalHold, refusal error) error {
+	var stood *Credentials
+	lockErr := m.store.withKeyLock(ctx, credKey, func() error {
+		stood = m.rememberRenewalHold(credKey, hold)
+		return nil
+	})
+	if lockErr != nil {
+		m.warnf("warning: could not lock the credential for %s to remember the token endpoint's refusal, so the next command will ask again: %v", credKey, lockErr)
+	}
+	if stood == nil {
+		return refusal
+	}
+	held := m.heldRenewal(stood)
+	if held == nil {
+		return refusal
+	}
+	return m.agentRemedy(held, stood.ClientID, stood.Scope)
+}
+
 // forSession names the session in a failed session mint's message, keeping
 // its class, hint and cause.
 func forSession(l *agentLaunch, err error) error {
 
@@ -2,6 +2,7 @@ package auth
 
 import (
 	"context"
+	"errors"
 	"net/http"
 	"strings"
 	"testing"
@@ -180,6 +181,100 @@ func TestSessionTokenRefusalOfTheCredentialIsHeld(t *testing.T) {
 	assert.Len(t, as.tokenCalls(), 1, "a held credential was presented again")
 }
 
+// TestConcurrentVerdictsOnTheSecretKeepTheLongerHold: a session mint holds
+// no lock across its round trip, so another mint's verdict on the same
+// secret can land while it is in flight. Whichever is written last, the
+// hold that stands is the one that holds longer, and the session is told
+// that one: a dead secret is not sent again a minute later because a 429
+// from the abuse tracker it tripped landed after its invalid_client.
+func TestConcurrentVerdictsOnTheSecretKeepTheLongerHold(t *testing.T) {
+	type answer struct {
+		status int
+		header http.Header
+		body   string
+	}
+	invalidClient := answer{http.StatusUnauthorized, nil, `{"error":"invalid_client"}`}
+	invalidGrant := answer{http.StatusBadRequest, nil, `{"error":"invalid_grant"}`}
+	rateLimited := func(seconds string) answer {
+		return answer{http.StatusTooManyRequests, http.Header{"Retry-After": {seconds}}, `{}`}
+	}
+
+	for name, tc := range map[string]struct {
+		// early is the verdict that lands while the session's mint is in
+		// flight, from another launch, or from the shared path when
+		// shared; late is the session's own.
+		early, late answer
+		shared      bool
+
+		kind  string
+		until time.Duration // from now; zero is never
+		// stood is whether the session is answered with the earlier
+		// verdict rather than its own; retryAfter is the wait it is told.
+		stood      bool
+		retryAfter int
+	}{
+		"a 429 after invalid_client":               {early: invalidClient, late: rateLimited("60"), kind: renewalHoldRefused, stood: true},
+		"a 429 after the shared path's refusal":    {early: invalidClient, late: rateLimited("60"), shared: true, kind: renewalHoldRefused, stood: true},
+		"a 429 after invalid_grant":                {early: invalidGrant, late: rateLimited("60"), kind: renewalHoldRefused, until: time.Hour, stood: true},
+		"a shorter 429 after a longer one":         {early: rateLimited("1800"), late: rateLimited("60"), kind: renewalHoldRateLimited, until: 30 * time.Minute, stood: true, retryAfter: 1800},
+		"invalid_client after a 429":               {early: rateLimited("60"), late: invalidClient, kind: renewalHoldRefused},
+		"a longer 429 after a shorter one":         {early: rateLimited("60"), late: rateLimited("1800"), kind: renewalHoldRateLimited, until: 30 * time.Minute, retryAfter: 1800},
+		"invalid_client after the shared path 429": {early: rateLimited("60"), late: invalidClient, shared: true, kind: renewalHoldRefused},
+	} {
+		t.Run(name, func(t *testing.T) {
+			e := startMintEndpoint(t)
+			first, key, now := heldManager(t, e)
+			second := newDeviceTestManager(t, e.srv.URL)
+			second.store, second.clock = first.store, first.clock
+			start := *now
+
+			e.answer = func(call int) (int, http.Header, string) {
+				a := tc.early
+				if call == 0 {
+					// The session's mint is in flight: the other verdict
+					// lands, and is written, before it is answered.
+					var err error
+					if tc.shared {
+						_, err = first.AccessToken(context.Background())
+					} else {
+						_, err = first.SessionAccessToken(context.Background(), "fedcba9876543210fedcba9876543210", "")
+					}
+					assert.Error(t, err)
+					a = tc.late
+				}
+				return a.status, a.header, a.body
+			}
+
+			_, err := second.SessionAccessToken(context.Background(), testSessionID, "coworker@box")
+			require.Error(t, err)
+			require.EqualValues(t, 2, e.calls.Load())
+			assert.Contains(t, err.Error(), testSessionID)
+			assert.Equal(t, tc.stood, errors.Is(err, errRenewalHeld), "whether the session was answered by the hold that stood")
+			assert.Equal(t, tc.retryAfter, RetryAfter(err), "the wait the session is told")
+			if tc.kind == renewalHoldRefused {
+				assert.ErrorIs(t, err, ErrAgentCredentialRefused)
+			}
+
+			stored, loadErr := second.store.Load(key)
+			require.NoError(t, loadErr)
+			require.NotNil(t, stored.RenewalHold)
+			assert.Equal(t, tc.kind, stored.RenewalHold.Kind)
+			var until int64
+			if tc.until != 0 {
+				until = start.Add(tc.until).Unix()
+			}
+			assert.Equal(t, until, stored.RenewalHold.Until)
+
+			// Past the shorter hold, nothing goes out from either launch.
+			*now = now.Add(2 * time.Minute)
+			_, err = second.SessionAccessToken(context.Background(), testSessionID, "coworker@box")
+			require.Error(t, err)
+			assert.ErrorIs(t, err, errRenewalHeld)
+			assert.EqualValues(t, 2, e.calls.Load(), "the shorter hold was written over the longer one")
+		})
+	}
+}
+
 // TestSessionTokenNeedsAnAgentProfile: only an agent credential mints for
 // itself; a person's login has no session to attribute and is not handed
 // out in place of one.
 
@@ -393,8 +393,37 @@ func (hold *RenewalHold) holds(creds *Credentials, now time.Time) bool {
 	}
 }
 
+// outlasts reports whether hold, stored on creds, answers mints for at
+// least as long as next would: it holds now, and never ends or ends after
+// next does.
+//
+// Two mints of one secret can be in flight at once, and their verdicts land
+// in either order, so the later write is not the later word. An
+// invalid_client refusal says the secret is dead for good, and a 429 that
+// lands after it — the abuse tracker the first refusals tripped answers
+// every request after them with one, whatever the secret — must not cut
+// that to a minute, after which the dead secret goes out again. Nor may a
+// shorter rate limit cut short a longer one the server asked for.
+func (hold *RenewalHold) outlasts(next *RenewalHold, creds *Credentials, now time.Time) bool {
+	switch {
+	case !hold.holds(creds, now):
+		return false
+	case hold.Until == 0:
+		return true
+	default:
+		return next.Until != 0 && hold.Until > next.Until
+	}
+}
+
 // rememberRenewalHold records hold on the stored credential — if the stored
-// credential is still the one the verdict was about.
+// credential is still the one the verdict was about, and no verdict it
+// already carries on it outlasts this one.
+//
+// It returns the stored credential when such a verdict stands and nothing
+// was written, so the caller can answer with it; nil otherwise. Only a mint
+// that held no lock across its round trip meets one: a session mint
+// (agent_launch.go), or any mint on a host without the lock. Under the lock,
+// a standing hold answers the mint before anything is sent.
 //
 // The caller holds the credential key's cross-process lock, so no login can
 // land between the refusal and this write. The fingerprint is compared
@@ -411,23 +440,27 @@ func (hold *RenewalHold) holds(creds *Credentials, now time.Time) bool {
 //
 // A failure to write is reported and otherwise changes nothing — the
 // refusal is what the caller sees either way.
-func (m *Manager) rememberRenewalHold(origin string, hold *RenewalHold) {
+func (m *Manager) rememberRenewalHold(origin string, hold *RenewalHold) (stood *Credentials) {
 	current, err := m.store.Load(origin)
 	if err != nil {
 		// A credential removed since the mint (a logout) has nothing to
 		// remember a refusal on; any other failure is worth saying.
 		if !errors.Is(err, ErrNoCredential) {
 			m.warnf("warning: could not read the credential for %s to remember the token endpoint's refusal, so the next command will ask again: %v", origin, err)
 		}
-		return
+		return nil
 	}
 	if renewalSubject(current) != hold.Client {
-		return
+		return nil
+	}
+	if current.RenewalHold.outlasts(hold, current, m.now()) {
+		return current
 	}
 	current.RenewalHold = hold
 	if err := m.store.Save(origin, current); err != nil {
 		m.warnf("warning: could not remember the token endpoint's refusal for %s, so the next command will ask again: %v", origin, err)
 	}
+	return nil
 }
 
 // now is the Manager's clock: the clock field when a test set one.