diff --git a/.github/workflows/docker-build-push.yml b/.github/workflows/docker-build-push.yml
index 1c54f80d..b8c96916 100644
--- a/.github/workflows/docker-build-push.yml
+++ b/.github/workflows/docker-build-push.yml
@@ -78,6 +78,11 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          build-args: ${{ matrix.service == 'cab-standalone-frontend' && format('VITE_COGNITIVE_TOKEN={0}', secrets.VITE_COGNITIVE_TOKEN) || '' }}
+          # VITE_* values are baked into the bundle at build time. VITE_POWERGRID_SIMU
+          # is the same-origin base the frontend posts "apply action" to; without it the
+          # POST lands on / and nginx answers 405. Blank lines are ignored by the action.
+          build-args: |
+            ${{ matrix.service == 'cab-standalone-frontend' && format('VITE_COGNITIVE_TOKEN={0}', secrets.VITE_COGNITIVE_TOKEN) || '' }}
+            ${{ matrix.service == 'cab-standalone-frontend' && 'VITE_POWERGRID_SIMU=/powergrid-simu' || '' }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
diff --git a/config/dev/cab-standalone/.env.example b/config/dev/cab-standalone/.env.example
index 04b75ccb..825583ac 100644
--- a/config/dev/cab-standalone/.env.example
+++ b/config/dev/cab-standalone/.env.example
@@ -12,14 +12,15 @@ HOST_IP=172.17.0.1
 #   Server    : http://192.168.208.61:5000/api/v1/recommendation         (LAN)
 #   Public    : https://interactiveagent.passerelle.irt-systemx.fr/api/v1/recommendation
 RL_AGENT_API_URL=http://host.docker.internal:5123/api/v1/recommendation
-RL_AGENT_API_TOKEN=619e707da0981a48d9982019d996f98e20bdd885eab8b20ae05b4ef0f2e95097
-
+RL_AGENT_API_TOKEN=
 # PowerGrid simulator upstream for the frontend's /powergrid-simu/ nginx proxy.
 # The frontend keeps VITE_POWERGRID_SIMU=/powergrid-simu (same-origin, no CORS);
 # only this upstream changes per environment:
 #   Local dev : http://host.docker.internal:5122/   (simulator container on the host)
 #   LAN       : http://192.168.208.61:5100/
-# (Public/k8s uses nginx-kubernetes.conf via the helm chart, not this variable.)
+#   Public    : https://interactivepowergrid.passerelle.irt-systemx.fr/
+# (Public/k8s deploys get this location from deploy-chart/configmap-assistant-platform.yaml,
+#  not from this variable.)
 POWERGRID_SIMU_UPSTREAM=http://host.docker.internal:5122/
 
 # VITE build-time variables (also required in frontend/env/.env.local for local dev)
diff --git a/config/dev/cab-standalone/nginx-cors-permissive.conf b/config/dev/cab-standalone/nginx-cors-permissive.conf
index 24577d55..2b4dc8bd 100644
--- a/config/dev/cab-standalone/nginx-cors-permissive.conf
+++ b/config/dev/cab-standalone/nginx-cors-permissive.conf
@@ -344,10 +344,16 @@ server {
 
     # PowerGrid simulator "apply action" proxy. The upstream is environment-specific
     # and injected at container start from $POWERGRID_SIMU_UPSTREAM (see start-webui.sh):
-    #   local -> http://host.docker.internal:5122/   LAN -> http://192.168.208.61:5100/
+    #   local  -> http://host.docker.internal:5122/
+    #   LAN    -> http://192.168.208.61:5100/
+    #   public -> https://interactivepowergrid.passerelle.irt-systemx.fr/
+    # No explicit Host header: nginx defaults it to $proxy_host (the authority from
+    # proxy_pass), which is what an ip:port upstream AND a vhost upstream both need.
+    # Forwarding $http_host instead would make the passerelle route to the wrong vhost.
     location /powergrid-simu/ {
-        proxy_set_header Host $http_host;
         proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_ssl_server_name on;
+        proxy_ssl_verify off;
         proxy_pass __POWERGRID_SIMU_UPSTREAM__;
     }
 
diff --git a/deploy-chart/configmap-assistant-platform.yaml b/deploy-chart/configmap-assistant-platform.yaml
index 895d2bc5..3a06da54 100644
--- a/deploy-chart/configmap-assistant-platform.yaml
+++ b/deploy-chart/configmap-assistant-platform.yaml
@@ -262,6 +262,19 @@ data:
             proxy_set_header X-Forwarded-For $remote_addr;
         }
 
+        # PowerGrid (grid2op) simulator "apply action" proxy. Keeps the browser POST
+        # same-origin (no CORS) — the frontend is built with
+        # VITE_POWERGRID_SIMU=/powergrid-simu and posts to /powergrid-simu/api/v1/recommendations.
+        # Host must be the upstream vhost, not $http_host: the passerelle routes by hostname.
+        location /powergrid-simu/ {
+            add_header Cache-Control "no-cache";
+            proxy_set_header Host interactivepowergrid.passerelle.irt-systemx.fr;
+            proxy_set_header X-Forwarded-For $remote_addr;
+            proxy_ssl_server_name on;
+            proxy_ssl_verify off;
+            proxy_pass https://interactivepowergrid.passerelle.irt-systemx.fr/;
+        }
+
         error_page 500 502 503 504 /50x.html;
         location = /50x.html {
             root /usr/share/nginx/html;
diff --git a/deploy-chart/values.ovh.yaml b/deploy-chart/values.ovh.yaml
index e6dc00cd..9da2074b 100644
--- a/deploy-chart/values.ovh.yaml
+++ b/deploy-chart/values.ovh.yaml
@@ -2,25 +2,25 @@ cabcontext:
   image:
     repository: harbor.irtsysx.fr/docker-proxy-cache/irtsystemx/interactiveai-cab-context
     pullPolicy: Always
-    tag: "1.3.6"
+    tag: "1.3.7"
 
 cabevent:
   image:
     repository: harbor.irtsysx.fr/docker-proxy-cache/irtsystemx/interactiveai-cab-event
     pullPolicy: Always
-    tag: "1.3.6"
+    tag: "1.3.7"
 
 cabhistoric:
   image:
     repository: harbor.irtsysx.fr/docker-proxy-cache/irtsystemx/interactiveai-cab-historic
     pullPolicy: Always
-    tag: "1.3.6"
+    tag: "1.3.7"
 
 cabrecommendation:
   image:
     repository: harbor.irtsysx.fr/docker-proxy-cache/irtsystemx/interactiveai-cab-recommendation
     pullPolicy: Always
-    tag: "1.3.6"
+    tag: "1.3.7"
   extraEnv:
     - name: RL_AGENT_API_URL
       value: "https://interactiveagent.passerelle.irt-systemx.fr/api/v1/recommendation"
@@ -34,10 +34,20 @@ cabcapitalization:
   image:
     repository: harbor.irtsysx.fr/docker-proxy-cache/irtsystemx/interactiveai-cab-capitalization
     pullPolicy: Always
-    tag: "1.3.6"
+    tag: "1.3.7"
 
 frontend:
   image:
     repository: harbor.irtsysx.fr/docker-proxy-cache/irtsystemx/interactiveai-cab-standalone-frontend
     pullPolicy: Always
-    tag: "1.3.6"
+    tag: "1.3.7"
+  extraEnv:
+    - name: VITE_POWERGRID_SIMU
+      value: "/powergrid-simu"
+    - name: POWERGRID_SIMU_UPSTREAM
+      value: "https://interactivepowergrid.passerelle.irt-systemx.fr/"
+    - name: VITE_COGNITIVE_TOKEN
+      valueFrom:
+        secretKeyRef:
+          name: cab-frontend
+          key: vite-cognitive-token
diff --git a/frontend/default.conf b/frontend/default.conf
index 1e81cc41..c7a9f6d2 100644
--- a/frontend/default.conf
+++ b/frontend/default.conf
@@ -39,10 +39,14 @@ server {
     # Proxy for the PowerGrid (grid2op) simulator — keeps the "apply" POST same-origin
     # so the browser never does a cross-origin request (avoids CORS entirely).
     # Frontend posts to /powergrid-simu/... with VITE_POWERGRID_SIMU=/powergrid-simu.
-    # NB: this upstream is a LAN address reachable from cab-standalone; adjust per environment.
+    # NB: this upstream is a LAN address reachable from cab-standalone; adjust per environment
+    # (public deployments use https://interactivepowergrid.passerelle.irt-systemx.fr/).
+    # No explicit Host header: nginx defaults it to $proxy_host, which is correct for an
+    # ip:port upstream and for a vhost upstream behind the passerelle alike.
     location /powergrid-simu/ {
-        proxy_set_header Host $http_host;
         proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_ssl_server_name on;
+        proxy_ssl_verify off;
         proxy_pass http://192.168.208.61:5100/;
     }
 }
diff --git a/frontend/src/App.vue b/frontend/src/App.vue
index 99727e7a..edc6bd3c 100644
--- a/frontend/src/App.vue
+++ b/frontend/src/App.vue
@@ -19,8 +19,13 @@ import Modal from './components/atoms/Modal.vue'
 import Navbar from './components/molecules/Navbar.vue'
 import { mode } from './plugins/colorMode'
 import { useAppStore } from './stores/app'
+import { useAuthStore } from './stores/auth'
 
 mode.value = 'auto'
 
 const appStore = useAppStore()
+
+// A session restored from localStorage has no refresh timer running yet; arm it
+// so a reloaded tab keeps renewing its token instead of dying at the next poll.
+useAuthStore().scheduleRefresh()
 </script>
diff --git a/frontend/src/api/auth.ts b/frontend/src/api/auth.ts
index fa5a28fd..37164375 100644
--- a/frontend/src/api/auth.ts
+++ b/frontend/src/api/auth.ts
@@ -14,6 +14,25 @@ export function login(username: string, password: string) {
   )
 }
 
+/**
+ * Exchanges the refresh token for a fresh access token. Client credentials are
+ * injected by the nginx proxy as a Basic auth header (same as `login`), so only
+ * the grant and the refresh token travel in the body.
+ */
+export function refreshToken(refresh_token: string) {
+  return http.post<LoginResponse>(
+    '/auth/token',
+    new URLSearchParams({
+      refresh_token,
+      grant_type: 'refresh_token',
+      clientId: 'opfab-client'
+    }),
+    // A dead refresh token is expected: the caller turns it into a session
+    // expiry, so it must not raise a generic error popup of its own.
+    { _silent: true }
+  )
+}
+
 export function checkToken(token: string) {
   return http.post<{ active: boolean }>(
     '/auth/check_token',
diff --git a/frontend/src/api/cards.ts b/frontend/src/api/cards.ts
index a5fb140a..ebcea3de 100644
--- a/frontend/src/api/cards.ts
+++ b/frontend/src/api/cards.ts
@@ -3,6 +3,7 @@ import i18n from '@/plugins/i18n'
 import { useAppStore } from '@/stores/app'
 import { useAuthStore } from '@/stores/auth'
 import type { Card, CardEvent } from '@/types/cards'
+import { handleSessionExpired } from '@/utils/session'
 
 let controller: AbortController = new AbortController()
 
@@ -15,7 +16,8 @@ export async function subscribe(
     rangeStart?: string
     notification?: 'true' | 'false'
   },
-  handler: (card: CardEvent) => void
+  handler: (card: CardEvent) => void,
+  retried = false
 ) {
   const authStore = useAuthStore()
   const appStore = useAppStore()
@@ -35,6 +37,13 @@ export async function subscribe(
       signal: controller.signal
     }
   )
+  // This request bypasses the axios interceptors, so the token dance lives here
+  if (response.status === 401) {
+    if (!retried && (await authStore.refresh())) return subscribe(config, handler, true)
+    appStore.status.notifications.state = 'OFFLINE'
+    handleSessionExpired()
+    return response
+  }
   const reader = response.body!.getReader()
   const decoder = new TextDecoder('utf-8')
   // eslint-disable-next-line no-constant-condition
diff --git a/frontend/src/entities/ATM/CAB/Context.vue b/frontend/src/entities/ATM/CAB/Context.vue
index 14b20887..3f87ea19 100644
--- a/frontend/src/entities/ATM/CAB/Context.vue
+++ b/frontend/src/entities/ATM/CAB/Context.vue
@@ -19,12 +19,11 @@ const servicesStore = useServicesStore()
 const mapStore = useMapStore()
 const appStore = useAppStore()
 
-const contextPID = ref(0)
 const faulty = ref(false)
 
 onBeforeMount(async () => {
   locale.value = `en-ATM`
-  contextPID.value = await servicesStore.getContext('ATM', (context: { data: ContextType }) => {
+  await servicesStore.getContext('ATM', (context: { data: ContextType }) => {
     // New context data: iterate over the airplanes array
     // 1-  Clear last tick's markers and ROUTE waypoints
     mapStore.removeCategoryWaypoint('ROUTE')
@@ -108,6 +107,6 @@ onBeforeMount(async () => {
 onUnmounted(() => {
   locale.value =
     window.navigator.language.split('-')[0] || import.meta.env.VITE_DEFAULT_LOCALE || 'en'
-  clearInterval(contextPID.value)
+  servicesStore.stopContext()
 })
 </script>
diff --git a/frontend/src/entities/PowerGrid/CAB/Context.vue b/frontend/src/entities/PowerGrid/CAB/Context.vue
index 619c209c..0d8cebda 100644
--- a/frontend/src/entities/PowerGrid/CAB/Context.vue
+++ b/frontend/src/entities/PowerGrid/CAB/Context.vue
@@ -40,7 +40,7 @@
 </template>
 <script setup lang="ts">
 import { TimerReset } from 'lucide-vue-next'
-import { computed, onBeforeMount, onUnmounted, ref } from 'vue'
+import { computed, onBeforeMount, onUnmounted } from 'vue'
 import { ZoomImg } from 'vue3-zoomer'
 
 import Button from '@/components/atoms/Button.vue'
@@ -52,7 +52,6 @@ import { useServicesStore } from '@/stores/services'
 const servicesStore = useServicesStore()
 const appStore = useAppStore()
 
-const contextPID = ref(0)
 
 const context = computed(
   () =>
@@ -61,11 +60,11 @@ const context = computed(
 )
 
 onBeforeMount(async () => {
-  contextPID.value = await servicesStore.getContext('PowerGrid')
+  await servicesStore.getContext('PowerGrid')
 })
 
 onUnmounted(() => {
-  clearInterval(contextPID.value)
+  servicesStore.stopContext()
 })
 </script>
 <style lang="scss">
diff --git a/frontend/src/entities/Railway/CAB/Context.vue b/frontend/src/entities/Railway/CAB/Context.vue
index 56613492..0a332317 100644
--- a/frontend/src/entities/Railway/CAB/Context.vue
+++ b/frontend/src/entities/Railway/CAB/Context.vue
@@ -13,7 +13,7 @@
   </Context>
 </template>
 <script setup lang="ts">
-import { onBeforeMount, onUnmounted, ref, watchEffect } from 'vue'
+import { onBeforeMount, onUnmounted, watchEffect } from 'vue'
 
 import Context from '@/components/organisms/CAB/Context.vue'
 import Map from '@/components/organisms/Map.vue'
@@ -29,7 +29,6 @@ const mapStore = useMapStore()
 const cardsStore = useCardsStore()
 const appStore = useAppStore()
 
-const contextPID = ref(0)
 
 watchEffect(() => {
   for (const train of cardsStore.cards('Railway'))
@@ -51,7 +50,7 @@ watchEffect(() => {
 })
 
 onBeforeMount(async () => {
-  contextPID.value = await servicesStore.getContext('Railway', (context) => {
+  await servicesStore.getContext('Railway', (context) => {
     for (const train of context.data.trains)
       mapStore.addContextWaypoint({
         lat: train.latitude,
@@ -66,6 +65,6 @@ onBeforeMount(async () => {
 })
 
 onUnmounted(() => {
-  clearInterval(contextPID.value)
+  servicesStore.stopContext()
 })
 </script>
diff --git a/frontend/src/locales/en.json b/frontend/src/locales/en.json
index a05c4beb..544186ec 100644
--- a/frontend/src/locales/en.json
+++ b/frontend/src/locales/en.json
@@ -64,6 +64,7 @@
   "modal.error.ERR_BAD_RESPONSE": "Server response error",
   "modal.error.ERR_NETWORK": "Network error",
   "modal.error.NO_CONTEXT": "Unable to retrieve recommendations without context",
+  "modal.error.SESSION_EXPIRED": "Your session has expired, please log in again",
   "modal.error.default": "Request to {url} failed with code {code} and message {message}",
   "modal.info.SUBSCRIPTION_ACTIVE": "A user is logged in, log them out?",
   "recommendations.description": "Description",
diff --git a/frontend/src/locales/fr.json b/frontend/src/locales/fr.json
index f6bf079b..9d5f8292 100644
--- a/frontend/src/locales/fr.json
+++ b/frontend/src/locales/fr.json
@@ -64,6 +64,7 @@
   "modal.error.ERR_BAD_RESPONSE": "Erreur réponse serveur",
   "modal.error.ERR_NETWORK": "Erreur réseau",
   "modal.error.NO_CONTEXT": "Impossible de récupérer les recommandations en l'absence de contexte",
+  "modal.error.SESSION_EXPIRED": "Votre session a expiré, veuillez vous reconnecter",
   "modal.error.default": "La requête à {url} a échoué avec le code {code} et le message {message}",
   "modal.info.SUBSCRIPTION_ACTIVE": "Un utilisateur est connecté, le déconnecter ?",
   "recommendations.description": "Description",
diff --git a/frontend/src/plugins/http.ts b/frontend/src/plugins/http.ts
index 73da579b..8447d3ee 100644
--- a/frontend/src/plugins/http.ts
+++ b/frontend/src/plugins/http.ts
@@ -1,13 +1,22 @@
 import axios, { AxiosError } from 'axios'
 
-import router from '@/router'
 import { useAppStore } from '@/stores/app'
 import { useAuthStore } from '@/stores/auth'
+import { handleSessionExpired, isHandlingSessionExpiry } from '@/utils/session'
 
 import i18n from './i18n'
 
 const { t } = i18n.global
 
+declare module 'axios' {
+  export interface AxiosRequestConfig {
+    /** Internal: this request was already replayed after a token refresh. */
+    _retried?: boolean
+    /** Suppress the generic error modal - the caller handles failures itself. */
+    _silent?: boolean
+  }
+}
+
 const http = axios.create({
   baseURL: import.meta.env.VITE_API,
   headers: { Accept: 'application/json' }
@@ -43,32 +52,41 @@ http.interceptors.response.use(
   async function (error: AxiosError<any, any>) {
     const authStore = useAuthStore()
     const appStore = useAppStore()
-    // TODO: TEMP HACK (eval-demo) — MUST BE REMOVED before next release
-    // Auto-logout on token expiry is fully disabled. Users stay logged in even when the token expires.
-    // This was done to avoid interruptions during the demo. Re-enable the block below when done.
-    // [DISABLED] Auto-logout on expired token — commented out to stay logged in despite failed requests
-    // If request failed, check if token is expired
-    // if (error.config?.url !== '/auth/check_token' && authStore.token?.access_token) {
-    //   const res = await authStore.checkToken()
-    //   if (!res) {
-    //     appStore._modals = []
-    //     appStore.addModal({
-    //       data: t('modal.error.DISCONNECTED'),
-    //       type: 'info',
-    //       callback: () => {
-    //         appStore.status.requests = []
-    //       }
-    //     })
-    //     authStore.logout()
-    //     router.push({ name: 'login' })
-    //     return
-    //   }
-    // } else {
-    //   // If the request that failed was the token check,
-    //   // then it is probably a network error and simply log out the user
-    //   authStore.logout()
-    //   router.push({ name: 'login' })
-    // }
+
+    // The access token is short-lived (5 min on the demo realm). A 401 usually
+    // just means it aged out mid-scenario, so renew it and replay the request
+    // once. Only when the refresh token is gone too is the session really over,
+    // and then we collapse the whole 401 burst into a single "log in again"
+    // modal rather than one raw error popup per failed request.
+    const isAuthRequest = ['/auth/token', '/auth/check_token'].includes(error.config?.url ?? '')
+    if (error.response?.status === 401 && !isAuthRequest) {
+      const config = error.config
+      if (config && !config._retried && authStore.canRefresh) {
+        config._retried = true
+        if (await authStore.refresh()) {
+          // Drop this attempt's LOADING entry; the replay pushes its own
+          appStore.status.requests.splice(
+            appStore.status.requests.findIndex((el) => el.data.url),
+            1
+          )
+          return http(config)
+        }
+      }
+      // Session is unrecoverable. Announce it once; stay silent afterwards
+      // (token already cleared) so trailing 401s produce no popups at all.
+      if (authStore.token?.access_token) handleSessionExpired()
+      return Promise.reject(error)
+    }
+    // Trailing failures of requests started before the expiry was detected, and
+    // calls that handle their own errors (the refresh grant), raise no popup.
+    if (isHandlingSessionExpiry() || error.config?._silent) {
+      appStore.status.requests.splice(
+        appStore.status.requests.findIndex((el) => el.data.url),
+        1
+      )
+      return Promise.reject(error)
+    }
+
     appStore.status.requests[appStore.status.requests.findIndex((el) => el.data.url)] = {
       state: 'ERROR',
       data: error
diff --git a/frontend/src/router/index.ts b/frontend/src/router/index.ts
index 6313abc8..09f48dad 100644
--- a/frontend/src/router/index.ts
+++ b/frontend/src/router/index.ts
@@ -2,6 +2,7 @@ import { createRouter, createWebHistory } from 'vue-router'
 
 import { useAuthStore } from '@/stores/auth'
 import { ENTITIES, type Entity } from '@/types/entities'
+import { handleSessionExpired } from '@/utils/session'
 import CAB from '@/views/CAB.vue'
 import Home from '@/views/Home.vue'
 import Login from '@/views/Login.vue'
@@ -36,9 +37,19 @@ const router = createRouter({
   ]
 })
 
-router.beforeEach((to) => {
+router.beforeEach(async (to) => {
   const authStore = useAuthStore()
 
+  // The auth store is persisted, so reopening the app restores a token that
+  // may already have aged out. Renew it here rather than letting every request
+  // 401; only a dead refresh token actually ends the session.
+  if (to.meta.auth && authStore.user && authStore.isTokenExpired) {
+    if (!(await authStore.refresh())) {
+      handleSessionExpired({ redirect: false })
+      return { name: 'login' }
+    }
+  }
+
   if (to.meta.auth && !authStore.user) return { name: 'login' }
   if (!to.meta.auth && authStore.user) return { name: 'home' }
   if (to.name === 'home' && authStore.entities.length === 1)
diff --git a/frontend/src/stores/auth.ts b/frontend/src/stores/auth.ts
index d3a4e876..560a6aab 100644
--- a/frontend/src/stores/auth.ts
+++ b/frontend/src/stores/auth.ts
@@ -5,6 +5,7 @@ import * as auth from '@/api/auth'
 import type { LoginResponse, UserResponse } from '@/types/auth'
 import { ENTITIES, type Entity } from '@/types/entities'
 import { clearCognitiveConsent } from '@/utils/consent'
+import { jwtExpiry, resetSessionExpiredGuard } from '@/utils/session'
 import { clearTraceSession, exportTraceSession, startTraceSession } from '@/utils/traceSessionExport'
 
 export const useAuthStore = defineStore(
@@ -13,6 +14,16 @@ export const useAuthStore = defineStore(
     const token = ref<LoginResponse>()
     const user = ref<UserResponse>()
     const expireDate = ref<number>()
+    const refreshExpireDate = ref<number>()
+
+    /** Refresh this long before the access token actually dies. */
+    const REFRESH_MARGIN_MS = 60_000
+    /** Never schedule a refresh closer than this, to avoid a hot loop. */
+    const MIN_REFRESH_DELAY_MS = 5_000
+
+    let refreshTimer: number | undefined
+    /** In-flight refresh, shared so a burst of 401s triggers only one call. */
+    let refreshing: Promise<boolean> | undefined
     const entities = computed(() =>
       user.value
         ? user.value.userData.entities
@@ -21,10 +32,84 @@ export const useAuthStore = defineStore(
         : []
     )
 
+    /**
+     * True when the persisted token is known to be expired. The `exp` claim is
+     * authoritative (it survives a reload); `expireDate` is only a fallback for
+     * tokens we cannot decode. When neither is readable we stay optimistic and
+     * let the API answer.
+     */
+    const isTokenExpired = computed(() => {
+      if (!token.value?.access_token) return true
+      const expiry = jwtExpiry(token.value.access_token) ?? expireDate.value
+      return expiry ? Date.now() >= expiry : false
+    })
+
+    /** True while the refresh token itself is still usable. */
+    const canRefresh = computed(
+      () =>
+        !!token.value?.refresh_token &&
+        (!refreshExpireDate.value || Date.now() < refreshExpireDate.value)
+    )
+
+    function applyToken(data: LoginResponse) {
+      token.value = data
+      expireDate.value = Date.now() + data.expires_in * 1000
+      refreshExpireDate.value = data.refresh_expires_in
+        ? Date.now() + data.refresh_expires_in * 1000
+        : undefined
+    }
+
+    /**
+     * Arms a timer that renews the access token shortly before it expires, so a
+     * long scenario never hits a 401 in the first place. Re-armed after every
+     * successful refresh; cleared on logout.
+     */
+    function scheduleRefresh() {
+      stopRefresh()
+      if (!canRefresh.value || !expireDate.value) return
+      const delay = Math.max(
+        expireDate.value - Date.now() - REFRESH_MARGIN_MS,
+        MIN_REFRESH_DELAY_MS
+      )
+      refreshTimer = window.setTimeout(() => void refresh(), delay)
+    }
+
+    function stopRefresh() {
+      if (refreshTimer !== undefined) window.clearTimeout(refreshTimer)
+      refreshTimer = undefined
+    }
+
+    /**
+     * Renews the access token. Concurrent callers share one request, so a burst
+     * of 401s cannot stampede Keycloak.
+     * @returns whether a usable token is now in place
+     */
+    function refresh(): Promise<boolean> {
+      if (refreshing) return refreshing
+      if (!canRefresh.value) return Promise.resolve(false)
+      refreshing = auth
+        .refreshToken(token.value!.refresh_token)
+        .then(({ data }) => {
+          applyToken(data)
+          resetSessionExpiredGuard()
+          scheduleRefresh()
+          return true
+        })
+        .catch(() => {
+          stopRefresh()
+          return false
+        })
+        .finally(() => {
+          refreshing = undefined
+        })
+      return refreshing
+    }
+
     async function login(username: string, password: string) {
       const tokenRes = await auth.login(username, password)
-      token.value = tokenRes.data
-      expireDate.value = Date.now() + tokenRes.data.expires_in * 1000
+      applyToken(tokenRes.data)
+      resetSessionExpiredGuard()
+      scheduleRefresh()
       const userRes = await auth.getCurrentUser()
       user.value = userRes.data
       try {
@@ -39,24 +124,45 @@ export const useAuthStore = defineStore(
       return data.active
     }
 
-    function logout(format: 'json' | 'csv' = 'json') {
+    /**
+     * @param format trace export format
+     * @param options `force: false` skips the export when the session recorded
+     *   no trace - used on session expiry so no empty file is downloaded
+     */
+    function logout(format: 'json' | 'csv' = 'json', options: { force?: boolean } = {}) {
       try {
         exportTraceSession(format, {
-          force: true,
+          force: options.force ?? true,
           userLogin: user.value?.userData.login
         })
       } catch (error) {
         console.warn('Unable to export trace session:', error)
       } finally {
+        stopRefresh()
         clearTraceSession()
         clearCognitiveConsent()
         token.value = undefined
         user.value = undefined
+        expireDate.value = undefined
+        refreshExpireDate.value = undefined
         localStorage.removeItem('context')
       }
     }
 
-    return { token, user, entities, login, logout, checkToken }
+    return {
+      token,
+      user,
+      expireDate,
+      refreshExpireDate,
+      entities,
+      isTokenExpired,
+      canRefresh,
+      login,
+      logout,
+      checkToken,
+      refresh,
+      scheduleRefresh
+    }
   },
   { persist: true }
 )
diff --git a/frontend/src/stores/services.ts b/frontend/src/stores/services.ts
index 92f3c7f7..582f5c0a 100644
--- a/frontend/src/stores/services.ts
+++ b/frontend/src/stores/services.ts
@@ -9,15 +9,29 @@ import type { Card } from '@/types/cards'
 import type { Context, Entity } from '@/types/entities'
 import type { FullContext, Recommendation } from '@/types/services'
 import { hasCognitiveConsent } from '@/utils/consent'
+import { isHandlingSessionExpiry } from '@/utils/session'
 import { getRootCard } from '@/utils/utils'
 
 import { useAppStore } from './app'
+import { useAuthStore } from './auth'
 
 const { t } = i18n.global
 
 export const useServicesStore = defineStore('services', () => {
   const _context = ref<FullContext>()
   const _recommendations = ref<Recommendation[]>([])
+  /**
+   * Live context-polling interval. Owned by the store so that a poll restarted
+   * from the retry modal is still cancellable - components only ever saw the
+   * id of the *first* interval, leaking every restarted one.
+   */
+  const _contextPID = ref(0)
+
+  /** Stops context polling, whichever interval is currently live. */
+  function stopContext() {
+    clearInterval(_contextPID.value)
+    _contextPID.value = 0
+  }
 
   // eslint-disable-next-line @typescript-eslint/no-unused-vars
   function context<E extends Entity>(entity: E) {
@@ -34,8 +48,6 @@ export const useServicesStore = defineStore('services', () => {
     callback: (context: FullContext<E>) => void = () => {},
     delay = 5000
   ) {
-    // Catch context error and reset interval
-    let contextPID = 0
     // Handler
     const handler = async () => {
       const appStore = useAppStore()
@@ -66,14 +78,17 @@ export const useServicesStore = defineStore('services', () => {
         appStore.status.context.last = Date.now()
       } catch (err) {
         appStore.status.context.state = 'OFFLINE'
-        clearInterval(contextPID)
+        stopContext()
+        // On session expiry the user is already being asked to log in again;
+        // once logged out there is nobody to ask about retrying either
+        if (isHandlingSessionExpiry() || !useAuthStore().token?.access_token) return
         useAppStore().addModal({
           data: t('modal.error.CONTEXT_FAILED'),
           type: 'choice',
           callback: (success) => {
             if (success) {
               handler()
-              contextPID = window.setInterval(handler, delay)
+              _contextPID.value = window.setInterval(handler, delay)
             }
           }
         })
@@ -82,8 +97,9 @@ export const useServicesStore = defineStore('services', () => {
     // Start context handler immediatly
     handler()
     // Start interval handler
-    contextPID = window.setInterval(handler, delay)
-    return contextPID
+    stopContext()
+    _contextPID.value = window.setInterval(handler, delay)
+    return _contextPID.value
   }
 
   async function getRecommendation<E extends Entity>(event: Card<E>, context = _context.value) {
@@ -131,6 +147,7 @@ export const useServicesStore = defineStore('services', () => {
     context,
     recommendations,
     getContext,
+    stopContext,
     getRecommendation
   }
 })
diff --git a/frontend/src/utils/session.ts b/frontend/src/utils/session.ts
new file mode 100644
index 00000000..753a2e67
--- /dev/null
+++ b/frontend/src/utils/session.ts
@@ -0,0 +1,87 @@
+import i18n from '@/plugins/i18n'
+import router from '@/router'
+import { useAppStore } from '@/stores/app'
+import { useAuthStore } from '@/stores/auth'
+
+const { t } = i18n.global
+
+/**
+ * Reads the `exp` claim of a JWT without verifying its signature.
+ * @param accessToken raw JWT
+ * @returns expiry timestamp in ms, or `undefined` if the token is unreadable
+ */
+export function jwtExpiry(accessToken: string) {
+  try {
+    const payload = accessToken.split('.')[1]
+    if (!payload) return undefined
+    // base64url -> base64, re-adding the padding JWTs strip
+    const base64 = payload.replace(/-/g, '+').replace(/_/g, '/')
+    const json = JSON.parse(
+      decodeURIComponent(
+        atob(base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '='))
+          .split('')
+          .map((char) => '%' + char.charCodeAt(0).toString(16).padStart(2, '0'))
+          .join('')
+      )
+    )
+    return typeof json.exp === 'number' ? json.exp * 1000 : undefined
+  } catch (err) {
+    return undefined
+  }
+}
+
+/**
+ * Guard so the burst of 401s triggered by a stale token (context polling, card
+ * subscription, current user, ...) only ever produces one modal and one redirect.
+ */
+let handling = false
+
+/**
+ * Single entry point for "this session is no longer usable".
+ * Silences every pending/queued request error, logs the user out and asks them
+ * to log in again instead of surfacing raw 401 payloads.
+ *
+ * @param options `redirect: false` when called from a navigation guard, which
+ *   returns its own redirect and must not be raced by a `router.push`
+ */
+export function handleSessionExpired(options: { redirect?: boolean } = {}) {
+  if (handling) return
+  handling = true
+
+  const appStore = useAppStore()
+  const authStore = useAuthStore()
+
+  // Drop the error modals/requests already queued by the 401 burst
+  appStore._modals = []
+  appStore.status.requests = []
+
+  // `force: false` -> only export traces if the session actually recorded some,
+  // so a stale token does not trigger a surprise file download on page load.
+  // Leaving the CAB route unsubscribes from the card stream (CAB.vue
+  // `onBeforeRouteLeave`), so nothing else needs tearing down here.
+  authStore.logout('json', { force: false })
+
+  appStore.addModal({
+    data: t('modal.error.SESSION_EXPIRED'),
+    type: 'info',
+    callback: () => {
+      handling = false
+    }
+  })
+
+  if ((options.redirect ?? true) && router.currentRoute.value.name !== 'login')
+    router.push({ name: 'login' })
+}
+
+/**
+ * True while a session expiry is being handled, so error handlers further down
+ * the promise chain can stay quiet instead of stacking their own modals.
+ */
+export function isHandlingSessionExpiry() {
+  return handling
+}
+
+/** Called after a successful login so a later expiry is handled again. */
+export function resetSessionExpiredGuard() {
+  handling = false
+}
diff --git a/frontend/src/views/CAB.vue b/frontend/src/views/CAB.vue
index 6b67728b..11d2d404 100644
--- a/frontend/src/views/CAB.vue
+++ b/frontend/src/views/CAB.vue
@@ -168,7 +168,9 @@ function reset(panel: 'left' | 'right' | 'bottom') {
 setup(route.params.entity as Entity)
 
 function setup(entity: Entity) {
-  cardsStore.subscribe(entity)
+  // Failures are already reported by the http interceptor (or handled as a
+  // session expiry); swallow the rejection so it does not leak to the console.
+  cardsStore.subscribe(entity).catch(() => {})
   locale.value = `${locale.value.slice(0, 2)}-${entity}`
   toggleMode(entity)
 
diff --git a/frontend/src/views/CAB/DefaultContext.vue b/frontend/src/views/CAB/DefaultContext.vue
index 01b7ed5c..36ee9269 100644
--- a/frontend/src/views/CAB/DefaultContext.vue
+++ b/frontend/src/views/CAB/DefaultContext.vue
@@ -4,20 +4,19 @@
   </Context>
 </template>
 <script setup lang="ts">
-import { onBeforeMount, onUnmounted, ref } from 'vue'
+import { onBeforeMount, onUnmounted } from 'vue'
 
 import Context from '@/components/organisms/CAB/Context.vue'
 import { useServicesStore } from '@/stores/services'
 
 const servicesStore = useServicesStore()
 
-const contextPID = ref(0)
 
 onBeforeMount(async () => {
-  contextPID.value = await servicesStore.getContext()
+  await servicesStore.getContext()
 })
 
 onUnmounted(() => {
-  clearInterval(contextPID.value)
+  servicesStore.stopContext()
 })
 </script>