@@ -23,9 +23,10 @@ import (
 type authEntryState string
 
 const (
-	authEntryStateSuccess = "success"
-	authEntryStateTimeout = "timeout"
-	authEntryStateError   = "error"
+	authEntryStateSuccess        = "success"
+	authEntryStateTimeout        = "timeout"
+	authEntryStateError          = "error"
+	authEntryStateRefreshExpired = "refresh_expired"
 )
 
 type authEntry struct {
@@ -128,6 +129,18 @@ func (e authEntry) String(cs *iostreams.ColorScheme) string {
 		}
 		activeStr := fmt.Sprintf("%v", e.Active)
 		sb.WriteString(fmt.Sprintf("  - Active account: %s\n", cs.Bold(activeStr)))
+
+	case authEntryStateRefreshExpired:
+		if e.Login != "" {
+			sb.WriteString(fmt.Sprintf("  %s Refresh token for %s account %s was rejected\n", cs.Red("X"), e.Host, cs.Bold(e.Login)))
+		} else {
+			sb.WriteString(fmt.Sprintf("  %s Refresh token for %s was rejected\n", cs.Red("X"), e.Host))
+		}
+		activeStr := fmt.Sprintf("%v", e.Active)
+		sb.WriteString(fmt.Sprintf("  - Active account: %s\n", cs.Bold(activeStr)))
+		sb.WriteString("  - The stored short-lived credential was removed because its refresh token is no longer valid.\n")
+		loginInstructions := fmt.Sprintf("gh auth login -h %s", e.Host)
+		sb.WriteString(fmt.Sprintf("  - To re-authenticate, run: %s\n", cs.Bold(loginInstructions)))
 	}
 
 	return sb.String()
@@ -413,6 +426,16 @@ func buildEntry(httpClient *http.Client, opts buildEntryOptions) authEntry {
 		justRefreshed:         opts.refreshStatus == gh.RefreshStatusDone,
 	}
 
+	// A rejected refresh token means the stored credential was already removed during resolution, leaving an empty
+	// token behind. Sending a scope request with it would produce a misleading generic failure, so surface the real
+	// reason and stop here. The token source is left empty on purpose: the credential is gone, so where it used to
+	// live is of no use to the user now.
+	if opts.refreshStatus == gh.RefreshStatusExpired {
+		entry.State = authEntryStateRefreshExpired
+		entry.Error = fmt.Sprintf("refresh token for %s was rejected; the stored credential was removed", opts.hostname)
+		return entry
+	}
+
 	// If token is not writeable, then it came from an environment variable and
 	// we need to fetch the username as it won't be stored in the config.
 	if !authTokenWriteable(tokenSource) {
 
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"path/filepath"
 	"strings"
@@ -339,6 +340,27 @@ func Test_statusRun(t *testing.T) {
 				  - Token scopes: 'repo', 'read:org'
 			`),
 		},
+		{
+			name: "rejected refresh token surfaces a clear error without a scope request",
+			opts: StatusOptions{},
+			cfgStubs: func(t *testing.T, c gh.Config) {
+				past := time.Date(2000, 1, 1, 0, 0, 0, 0, time.UTC)
+				loginRefreshable(t, c, "github.com", "monalisa", "gho_stale", "ghr_abc", &past)
+				setRefresher(t, c, &ghmock.TokenRefresherMock{
+					RefreshFunc: func(string, string) (gh.RefreshableCredential, error) {
+						return gh.RefreshableCredential{}, fmt.Errorf("server rejected token: %w", gh.ErrRefreshTokenInvalid)
+					},
+				})
+			},
+			wantErr: cmdutil.SilentError,
+			wantErrOut: heredoc.Doc(`
+				github.com
+				  X Refresh token for github.com account monalisa was rejected
+				  - Active account: true
+				  - The stored short-lived credential was removed because its refresh token is no longer valid.
+				  - To re-authenticate, run: gh auth login -h github.com
+			`),
+		},
 		{
 			name:     "token from env",
 			opts:     StatusOptions{},
@@ -786,6 +808,24 @@ func Test_statusRun(t *testing.T) {
 			wantOut: `{"hosts":{"github.com":[{"state":"timeout","error":"Get \"https://api.github.com/\": context deadline exceeded","active":true,"host":"github.com","login":"monalisa","tokenSource":"GH_CONFIG_DIR/hosts.yml","gitProtocol":"https"}]}}` + "\n",
 			wantErr: nil, // should not return error in machine-readable mode
 		},
+		{
+			name: "json, rejected refresh token",
+			opts: StatusOptions{
+				Hostname: "github.com",
+			},
+			jsonFields: []string{"hosts"},
+			cfgStubs: func(t *testing.T, c gh.Config) {
+				past := time.Date(2000, 1, 1, 0, 0, 0, 0, time.UTC)
+				loginRefreshable(t, c, "github.com", "monalisa", "gho_stale", "ghr_abc", &past)
+				setRefresher(t, c, &ghmock.TokenRefresherMock{
+					RefreshFunc: func(string, string) (gh.RefreshableCredential, error) {
+						return gh.RefreshableCredential{}, fmt.Errorf("server rejected token: %w", gh.ErrRefreshTokenInvalid)
+					},
+				})
+			},
+			wantOut: `{"hosts":{"github.com":[{"state":"refresh_expired","error":"refresh token for github.com was rejected; the stored credential was removed","active":true,"host":"github.com","login":"monalisa","tokenSource":"","gitProtocol":"https"}]}}` + "\n",
+			wantErr: nil, // should not return error in machine-readable mode
+		},
 		{
 			name: "json, with show token",
 			opts: StatusOptions{