diff --git a/frontend/app/src/app/modules/auth/auth.provider.spec.ts b/frontend/app/src/app/modules/auth/auth.provider.spec.ts
index 49a691fb..bfea20cf 100644
--- a/frontend/app/src/app/modules/auth/auth.provider.spec.ts
+++ b/frontend/app/src/app/modules/auth/auth.provider.spec.ts
@@ -440,6 +440,26 @@ describe('AuthProvider', () => {
     });
   });
 
+  describe('failed sign-in', () => {
+    it('keeps an existing session', async () => {
+      await givenLoadedToken(makeToken({accessToken: 'still-valid'}));
+
+      internals.notify({action: AuthActions.SignInFailed, error: new Error('state mismatch')});
+
+      expect(await isLoggedIn()).toBeTrue();
+      expect(internals.tokenSubject.value?.accessToken).toBe('still-valid');
+      expect(storageRemoveItem).not.toHaveBeenCalled();
+    });
+
+    it('stays logged out without a session', async () => {
+      await givenLoadedToken(null);
+
+      internals.notify({action: AuthActions.SignInFailed, error: new Error('access_denied')});
+
+      expect(await isLoggedIn()).toBeFalse();
+    });
+  });
+
   describe('signOut', () => {
     /** The [token, token_type_hint, client_id] of each revoke request, in order. */
     const revokedTokens = () =>
diff --git a/frontend/app/src/app/modules/auth/auth.provider.ts b/frontend/app/src/app/modules/auth/auth.provider.ts
index e91b3b68..bf64ebb9 100644
--- a/frontend/app/src/app/modules/auth/auth.provider.ts
+++ b/frontend/app/src/app/modules/auth/auth.provider.ts
@@ -1304,7 +1304,6 @@ export class AuthProvider {
     action: IAuthAction,
   ): void {
     switch (action.action) {
-      case AuthActions.SignInFailed:
       case AuthActions.SignOutSuccess:
       case AuthActions.SignOutFailed:
       case AuthActions.SessionExpired: {