@@ -220,19 +220,22 @@ export class Session extends BaseResource implements SessionResource {
     const current = SessionTokenCache.get({ tokenId })?.entry.resolvedToken ?? null;
 
     // A token whose explicit org claim differs from the active org is stale-context: it must
-    // not win lastActiveToken over a cached active-context token, nor be written into the
-    // active cache slot that getToken() reads. A token with no org claim is legacy/personal
-    // and counts as same-context.
+    // not win lastActiveToken nor be written into the active cache slot that getToken() reads.
+    // A token with no org claim is legacy/personal and counts as same-context. The freshness
+    // baseline falls back to the token we already hold when the active cache slot is empty
+    // (evicted, or a fetch still pending leaves resolvedToken null), so a staler or wrong-org
+    // piggyback can never regress lastActiveToken.
     const incomingOrg = tokenOrgId(incoming);
     const sameContext = !incomingOrg || normalizeOrgId(incomingOrg) === normalizeOrgId(this.lastActiveOrganizationId);
+    const baseline = current ?? this.lastActiveToken;
 
-    if (current && (!sameContext || isStrictlyStalerJwt(incoming, current))) {
-      this.lastActiveToken = current;
+    if (!sameContext || (baseline && isStrictlyStalerJwt(incoming, baseline))) {
+      this.lastActiveToken = baseline;
       return;
     }
 
     this.lastActiveToken = incoming;
-    if (sameContext && (!current || current.getRawString() !== incoming.getRawString())) {
+    if (!current || current.getRawString() !== incoming.getRawString()) {
       SessionTokenCache.set({
         tokenId,
         tokenResolver: Promise.resolve(incoming),
 
@@ -2419,6 +2419,52 @@ describe('Session', () => {
         expect(session.lastActiveToken?.getRawString()).toBe(legacy);
         expect(SessionTokenCache.get({ tokenId })?.entry.resolvedToken?.getRawString()).toBe(legacy);
       });
+
+      it('keeps the held lastActiveToken when a strictly-staler same-context token arrives and the cache slot is empty', async () => {
+        const high = createJwtWithOiat(NOW, NOW + 30);
+        const low = createJwtWithOiat(NOW, NOW);
+        const session = makeSession();
+
+        (session as any).fromJSON(sessionJsonWith(high));
+        await flush();
+        expect(session.lastActiveToken?.getRawString()).toBe(high);
+
+        SessionTokenCache.clear();
+
+        (session as any).fromJSON(sessionJsonWith(low));
+        await flush();
+
+        expect(session.lastActiveToken?.getRawString()).toBe(high);
+      });
+
+      it('rejects a wrong-org last_active_token even when the active-org cache slot is empty', async () => {
+        const orgBToken = createJwtWithOiat(NOW, NOW + 30, { org: 'org_B' });
+        const orgAToken = createJwtWithOiat(NOW, NOW + 60, { org: 'org_A' });
+        const session = makeSession({ last_active_organization_id: 'org_B' } as Partial<SessionJSON>);
+        const orgBJson = (jwt: string) =>
+          ({
+            status: 'active',
+            id: 'session_1',
+            object: 'session',
+            user: createUser({}),
+            last_active_organization_id: 'org_B',
+            actor: null,
+            created_at: Date.now(),
+            updated_at: Date.now(),
+            last_active_token: { object: 'token', jwt },
+          }) as SessionJSON;
+
+        (session as any).fromJSON(orgBJson(orgBToken));
+        await flush();
+        expect(session.lastActiveToken?.getRawString()).toBe(orgBToken);
+
+        SessionTokenCache.clear();
+
+        (session as any).fromJSON(orgBJson(orgAToken));
+        await flush();
+
+        expect(session.lastActiveToken?.getRawString()).toBe(orgBToken);
+      });
     });
   });
 });