diff --git a/src/handlers/http/middleware.rs b/src/handlers/http/middleware.rs
index cd3797bfb..13332968d 100644
--- a/src/handlers/http/middleware.rs
+++ b/src/handlers/http/middleware.rs
@@ -474,6 +474,18 @@ pub async fn refresh_token(
         };
 
         if let Some(oauth_data) = bearer_to_refresh {
+            if !oauth_data
+                .bearer
+                .as_ref()
+                .and_then(|bearer| bearer.refresh_token.as_deref())
+                .is_some_and(|token| !token.is_empty())
+            {
+                Users.remove_session(key);
+                return Err(ErrorUnauthorized(
+                    "Your OIDC session cannot be refreshed because the identity provider did not issue a refresh token. Please sign in again and ask your administrator to configure the offline_access scope.",
+                ));
+            }
+
             let refreshed_token = match client
                 .read()
                 .await