diff --git a/plugins/auth-backend/src/lib/OAuthProvider.ts b/plugins/auth-backend/src/lib/OAuthProvider.ts
index f2b8c8e09c..8e9cd510b3 100644
--- a/plugins/auth-backend/src/lib/OAuthProvider.ts
+++ b/plugins/auth-backend/src/lib/OAuthProvider.ts
@@ -258,6 +258,13 @@ export class OAuthProvider implements AuthProviderRouteHandlers {
 
       await this.populateIdentity(response.backstageIdentity);
 
+      if (
+        response.providerInfo.refreshToken &&
+        response.providerInfo.refreshToken !== refreshToken
+      ) {
+        this.setRefreshTokenCookie(res, response.providerInfo.refreshToken);
+      }
+
       res.send(response);
     } catch (error) {
       res.status(401).send(`${error.message}`);
diff --git a/plugins/auth-backend/src/lib/PassportStrategyHelper.ts b/plugins/auth-backend/src/lib/PassportStrategyHelper.ts
index 4cc0de4444..9a169f9696 100644
--- a/plugins/auth-backend/src/lib/PassportStrategyHelper.ts
+++ b/plugins/auth-backend/src/lib/PassportStrategyHelper.ts
@@ -45,7 +45,6 @@ export const makeProfileInfo = (
   if ((!email || !picture) && idToken) {
     try {
       const decoded: Record<string, string> = jwtDecoder(idToken);
-
       if (!email && decoded.email) {
         email = decoded.email;
       }
@@ -133,7 +132,7 @@ export const executeRefreshTokenStrategy = async (
       (
         err: Error | null,
         accessToken: string,
-        _refreshToken: string,
+        newRefreshToken: string,
         params: any,
       ) => {
         if (err) {
@@ -149,6 +148,7 @@ export const executeRefreshTokenStrategy = async (
 
         resolve({
           accessToken,
+          refreshToken: newRefreshToken,
           params,
         });
       },
diff --git a/plugins/auth-backend/src/providers/oauth2/provider.ts b/plugins/auth-backend/src/providers/oauth2/provider.ts
index c03f7c4371..3a8982c680 100644
--- a/plugins/auth-backend/src/providers/oauth2/provider.ts
+++ b/plugins/auth-backend/src/providers/oauth2/provider.ts
@@ -55,6 +55,7 @@ export class OAuth2AuthProvider implements OAuthProviderHandlers {
         done: PassportDoneCallback<OAuthResponse, PrivateInfo>,
       ) => {
         const profile = makeProfileInfo(rawProfile, params.id_token);
+
         done(
           undefined,
           {
@@ -101,21 +102,24 @@ export class OAuth2AuthProvider implements OAuthProviderHandlers {
   }
 
   async refresh(refreshToken: string, scope: string): Promise<OAuthResponse> {
-    const { accessToken, params } = await executeRefreshTokenStrategy(
+    const refreshTokenResponse = await executeRefreshTokenStrategy(
       this._strategy,
       refreshToken,
       scope,
     );
+    const { accessToken, params } = refreshTokenResponse;
+    const updatedRefreshToken = refreshTokenResponse.refreshToken;
 
     const profile = await executeFetchUserProfileStrategy(
       this._strategy,
-      accessToken,
-      params.id_token,
+      refreshTokenResponse.accessToken,
+      refreshTokenResponse.params.id_token,
     );
 
     return this.populateIdentity({
       providerInfo: {
         accessToken,
+        refreshToken: updatedRefreshToken,
         idToken: params.id_token,
         expiresInSeconds: params.expires_in,
         scope: params.scope,
@@ -134,7 +138,6 @@ export class OAuth2AuthProvider implements OAuthProviderHandlers {
     if (!profile.email) {
       throw new Error('Profile does not contain a profile');
     }
-
     const id = profile.email.split('@')[0];
 
     return { ...response, backstageIdentity: { id } };
diff --git a/plugins/auth-backend/src/providers/types.ts b/plugins/auth-backend/src/providers/types.ts
index d372fd1b94..0d4b7c656a 100644
--- a/plugins/auth-backend/src/providers/types.ts
+++ b/plugins/auth-backend/src/providers/types.ts
@@ -259,6 +259,10 @@ export type OAuthProviderInfo = {
    * Scopes granted for the access token.
    */
   scope: string;
+  /**
+   * A refresh token issued for the signed in user
+   */
+  refreshToken?: string;
 };
 
 export type OAuthPrivateInfo = {
@@ -326,6 +330,10 @@ export type RefreshTokenResponse = {
    * An access token issued for the signed in user.
    */
   accessToken: string;
+  /**
+   * Optionally, the server can issue a new Refresh Token for the user
+   */
+  refreshToken?: string;
   params: any;
 };