@@ -90,10 +90,9 @@ func tokenRun(opts *TokenOptions) error {
 	// --secure-storage: read the token straight from the keyring and consult no environment variable or config
 	// entry at all.
 	case opts.SecureStorage && !opts.NoRefresh:
-		// We cannot use ActiveToken or ActiveTokenWithRefresh upfront here: with no username they resolve the active
-		// token, which an environment variable such as GH_TOKEN can shadow, defeating --secure-storage. So when no
-		// username is given we resolve one and look the token up under it directly in the keyring. The refresh path
-		// does not need this fallback because a refreshable token is always stored under a user.
+		// We resolve a username for the refresh lookup because a refreshable token is always stored under a user,
+		// and ActiveTokenWithRefresh cannot be used upfront: with no username it resolves the active token, which an
+		// environment variable such as GH_TOKEN can shadow, defeating --secure-storage.
 		user := resolveUsername(authCfg, hostname, opts.Username)
 		var cred gh.Credential
 		if user != "" {
@@ -102,26 +101,30 @@ func tokenRun(opts *TokenOptions) error {
 		if cred.IsRefreshable() {
 			val = cred.Token
 		} else {
-			val = getNonRefreshableTokenFromKeyring(authCfg, hostname, user)
+			// Non-refreshable fallback: read the keyring keyed on the actual flag value, so an omitted --user reads
+			// the legacy unkeyed slot exactly as the original --secure-storage behaviour did, not a per-user slot.
+			val = getNonRefreshableTokenFromKeyring(authCfg, hostname, opts.Username)
 		}
 
 	// --secure-storage --no-refresh: rare combination with no known caller. Respect --secure-storage strictly and
 	// return the token only when it actually came from the keyring, otherwise nothing. The nature of the credential
 	// (refreshable or not) is irrelevant here because refreshing was also declined, so there is no lifecycle to
 	// honor; whoever passed --secure-storage wants the securely stored token specifically, so that is respected.
 	case opts.SecureStorage && opts.NoRefresh:
-		// As in the case above, ActiveToken cannot be used upfront because an environment variable such as GH_TOKEN
-		// can shadow the active token. So when no username is given we resolve one and read its keyring token
-		// directly, falling back to the legacy unkeyed keyring slot when no active user is recorded.
+		// We read under the resolved user so a refreshable token stored in the keyring is still surfaced, but only
+		// return it when it genuinely came from the keyring. ActiveToken cannot be used upfront because an
+		// environment variable such as GH_TOKEN can shadow the active token.
 		user := resolveUsername(authCfg, hostname, opts.Username)
 		var cred gh.Credential
 		if user != "" {
 			cred = getTokenReadOnly(authCfg, hostname, user)
-		} else if token, err := authCfg.TokenFromKeyring(hostname); err == nil {
-			cred = gh.Credential{Source: gh.TokenSourceKeyring, Token: token}
 		}
 		if cred.Source == gh.TokenSourceKeyring {
 			val = cred.Token
+		} else {
+			// Non-refreshable fallback: read the keyring keyed on the actual flag value, so an omitted --user reads
+			// the legacy unkeyed slot exactly as the original --secure-storage behaviour did, not a per-user slot.
+			val = getNonRefreshableTokenFromKeyring(authCfg, hostname, opts.Username)
 		}
 	}
 
 
@@ -10,6 +10,7 @@ import (
 	"github.com/cli/cli/v2/internal/config"
 	"github.com/cli/cli/v2/internal/gh"
 	ghmock "github.com/cli/cli/v2/internal/gh/mock"
+	"github.com/cli/cli/v2/internal/keyring"
 	"github.com/cli/cli/v2/pkg/cmdutil"
 	"github.com/cli/cli/v2/pkg/iostreams"
 	"github.com/google/shlex"
@@ -344,6 +345,17 @@ func TestTokenRunSecureStorage(t *testing.T) {
 			wantErr:    true,
 			wantErrMsg: "no oauth token found for ghe.io account test-user",
 		},
+		{
+			// Regression guard: with --user omitted but an active user recorded, the non-refreshable keyring
+			// fallback must read the legacy unkeyed slot (keyed on the empty flag value), not the active user's
+			// per-user slot. See the deleted per-user slot below.
+			name: "state 3: legacy unkeyed keyring token is returned when --user is omitted",
+			opts: TokenOptions{},
+			cfgStubs: func(t *testing.T, cfg gh.Config) {
+				setupLegacyUnkeyedKeyringState(t, cfg)
+			},
+			wantStdout: "gho_LEGACY\n",
+		},
 
 		// State 4: --secure-storage with --no-refresh (rare; return only keyring-sourced tokens).
 		{
@@ -405,6 +417,16 @@ func TestTokenRunSecureStorage(t *testing.T) {
 			},
 			wantStdout: "gho_ABCDEFG\n",
 		},
+		{
+			// Regression guard, as in state 3 but with --no-refresh: the keyring fallback must key on the flag
+			// value, so an omitted --user reads the legacy unkeyed slot rather than the active user's per-user slot.
+			name: "state 4: legacy unkeyed keyring token is returned when --user is omitted",
+			opts: TokenOptions{NoRefresh: true},
+			cfgStubs: func(t *testing.T, cfg gh.Config) {
+				setupLegacyUnkeyedKeyringState(t, cfg)
+			},
+			wantStdout: "gho_LEGACY\n",
+		},
 	}
 
 	for _, tt := range tests {
@@ -446,6 +468,17 @@ func login(t *testing.T, c gh.Config, hostname, username, token, gitProtocol str
 	require.NoError(t, err)
 }
 
+// setupLegacyUnkeyedKeyringState recreates the state a very old gh install leaves behind: an active user is recorded
+// for github.com, but the only keyring token lives in the legacy unkeyed slot rather than a per-user slot. It logs in
+// to record the active user, deletes the per-user keyring slot that login writes, and sets the unkeyed slot. The
+// keyring service name mirrors config.keyringServiceName, which is unexported.
+func setupLegacyUnkeyedKeyringState(t *testing.T, c gh.Config) {
+	t.Helper()
+	login(t, c, "github.com", "test-user", "gho_PERUSER", "https", true)
+	require.NoError(t, keyring.Delete("gh:github.com", "test-user"))
+	require.NoError(t, keyring.Set("gh:github.com", "", "gho_LEGACY"))
+}
+
 func loginRefreshable(t *testing.T, c gh.Config, hostname, username, accessToken, refreshToken string, secureStorage bool) {
 	t.Helper()
 	loginRefreshableWithExpiry(t, c, hostname, username, accessToken, refreshToken, secureStorage, nil)