diff --git a/.changeset/giant-olives-protect.md b/.changeset/giant-olives-protect.md
new file mode 100644
index 0000000000..915a42ff57
--- /dev/null
+++ b/.changeset/giant-olives-protect.md
@@ -0,0 +1,5 @@
+---
+'@backstage/backend-app-api': patch
+---
+
+Fixed a bug where expired cookies would not be refreshed.
diff --git a/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts b/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts
index db36e5bf2a..06e65a1413 100644
--- a/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts
+++ b/packages/backend-app-api/src/services/implementations/httpAuth/httpAuthServiceFactory.ts
@@ -235,14 +235,24 @@ class DefaultHttpAuthService implements HttpAuthService {
       return undefined;
     }
 
-    const existingCredentials = await this.#auth.authenticate(existingCookie, {
-      allowLimitedAccess: true,
-    });
-    if (!this.#auth.isPrincipal(existingCredentials, 'user')) {
-      return undefined;
-    }
+    try {
+      const existingCredentials = await this.#auth.authenticate(
+        existingCookie,
+        {
+          allowLimitedAccess: true,
+        },
+      );
+      if (!this.#auth.isPrincipal(existingCredentials, 'user')) {
+        return undefined;
+      }
 
-    return existingCredentials.expiresAt;
+      return existingCredentials.expiresAt;
+    } catch (error) {
+      if (error.name === 'AuthenticationError') {
+        return undefined;
+      }
+      throw error;
+    }
   }
 }