@@ -417,13 +417,13 @@ private async Task<string> GetAccessTokenCoreAsync(HttpResponseMessage response,
                     return steppedUpToken.AccessToken;
                 }
 
-                // The step-up that already requested these scopes may still be pending: the request
-                // that started it was canceled while the user was completing it. Its outcome is what
-                // will satisfy this challenge, so join it rather than reject the challenge as repeated.
-                if (_inFlightAuthorizationCodeFlow is { IsCompleted: false } pendingStepUp &&
-                    InFlightAuthorizationCodeFlowCoversChallenge(protectedResourceMetadata))
+                // The step-up that already requested these scopes may still be pending (the request
+                // that started it was canceled while the user was completing it) or may have completed
+                // since the cache was read above. Either way its outcome is what satisfies this
+                // challenge, so reuse it rather than reject the challenge as repeated.
+                if (await TryReuseInFlightAuthorizationCodeFlowAsync(protectedResourceMetadata, usedAccessToken, cancellationToken).ConfigureAwait(false) is { } steppedUpAccessToken)
                 {
-                    return await pendingStepUp.WaitAsync(cancellationToken).ConfigureAwait(false);
+                    return steppedUpAccessToken;
                 }
 
                 ThrowFailedToHandleUnauthorizedResponse(
@@ -519,29 +519,60 @@ private async Task<string> GetAccessTokenCoreAsync(HttpResponseMessage response,
         // Store auth server metadata for future refresh operations
         _authServerMetadata = authServerMetadata;
 
-        // Perform the OAuth flow. A caller that reaches this point while a previous caller's flow is
-        // still pending (that caller's request was canceled mid-flow, releasing the lock) joins the
-        // in-flight flow instead of starting a competing one, provided the flow requested every scope
-        // this challenge needs; see the _inFlightAuthorizationCodeFlow comment.
-        var flow = _inFlightAuthorizationCodeFlow;
-        if (flow is { IsCompleted: false } && !InFlightAuthorizationCodeFlowCoversChallenge(protectedResourceMetadata))
+        // Perform the OAuth flow, unless the in-flight flow already satisfies this challenge: a caller
+        // that reaches this point while a previous caller's flow is still pending (that caller's
+        // request was canceled mid-flow, releasing the lock) joins it instead of starting a competing
+        // one, and a flow that completed during the metadata work above has cached the token this
+        // challenge needs. See the _inFlightAuthorizationCodeFlow comment.
+        if (await TryReuseInFlightAuthorizationCodeFlowAsync(protectedResourceMetadata, usedAccessToken, cancellationToken).ConfigureAwait(false) is { } reusedAccessToken)
         {
-            // The pending flow's token cannot satisfy this challenge, but two interactive flows must
-            // never be presented at once, so let it settle first. Its outcome, success or failure, is
-            // reported to the callers that joined it and is irrelevant here (Task.WhenAny never
-            // faults); this challenge then runs its own step-up for the accumulated scopes.
-            await Task.WhenAny(flow).WaitAsync(cancellationToken).ConfigureAwait(false);
-            flow = null;
+            return reusedAccessToken;
         }
 
-        if (flow is null || flow.IsCompleted)
+        if (_inFlightAuthorizationCodeFlow is { IsCompleted: false } pendingFlow)
         {
-            _inFlightAuthorizationCodeFlow = flow = StartAuthorizationCodeFlow(protectedResourceMetadata, authServerMetadata, _disposeCts.Token);
+            // The pending flow did not request a scope this challenge needs, so its token cannot
+            // satisfy it, but two interactive flows must never be presented at once: let it settle
+            // first. Its outcome, success or failure, is reported to the callers that joined it and
+            // is irrelevant here (Task.WhenAny never faults).
+            await Task.WhenAny(pendingFlow).WaitAsync(cancellationToken).ConfigureAwait(false);
         }
 
+        var flow = _inFlightAuthorizationCodeFlow = StartAuthorizationCodeFlow(protectedResourceMetadata, authServerMetadata, _disposeCts.Token);
         return await flow.WaitAsync(cancellationToken).ConfigureAwait(false);
     }
 
+    /// <summary>
+    /// Satisfies the current challenge from the in-flight authorization-code flow when that flow requested
+    /// every scope the challenge needs: joins the flow while it is pending, or reuses the token it cached
+    /// if it completed after the caller last consulted the cache. Returns <see langword="null"/> when there
+    /// is no such flow or nothing usable came of it, in which case the caller runs a flow of its own.
+    /// </summary>
+    private async Task<string?> TryReuseInFlightAuthorizationCodeFlowAsync(ProtectedResourceMetadata protectedResourceMetadata, string? usedAccessToken, CancellationToken cancellationToken)
+    {
+        if (_inFlightAuthorizationCodeFlow is not { } flow || !InFlightAuthorizationCodeFlowCoversChallenge(protectedResourceMetadata))
+        {
+            return null;
+        }
+
+        if (!flow.IsCompleted)
+        {
+            return await flow.WaitAsync(cancellationToken).ConfigureAwait(false);
+        }
+
+        // A flow that ran to completion stored its token, and a token other than the one this challenge
+        // rejected is worth retrying with. A flow that faulted or was canceled stored nothing, and a
+        // long-completed flow's token is the rejected one itself.
+        if (flow.Status == TaskStatus.RanToCompletion &&
+            await _tokenCache.GetTokensAsync(cancellationToken).ConfigureAwait(false) is { IsExpired: false } cached &&
+            !string.Equals(cached.AccessToken, usedAccessToken, StringComparison.Ordinal))
+        {
+            return cached.AccessToken;
+        }
+
+        return null;
+    }
+
     /// <summary>
     /// Returns whether the in-flight authorization-code flow requested every scope the current challenge
     /// requires, so that joining it can satisfy the challenge. A challenge that names no concrete scope is
@@ -792,10 +823,12 @@ private Task<string> StartAuthorizationCodeFlow(
         var codeChallenge = GenerateCodeChallenge(codeVerifier);
         var state = GenerateRandomBase64UrlValue();
 
-        // Building the URL folds this challenge's scopes into _accumulatedScopes, so the accumulated set
-        // is now exactly the set of scopes this flow asks the authorization server for.
-        var authUrl = BuildAuthorizationUrl(protectedResourceMetadata, authServerMetadata, codeChallenge, state);
-        _inFlightAuthorizationCodeFlowScopes = new HashSet<string>(_accumulatedScopes, StringComparer.Ordinal);
+        // Record the scopes this flow actually asks the authorization server for: the effective scope
+        // placed in the URL, which offline_access augmentation and any ScopeSelector can make differ
+        // from _accumulatedScopes.
+        var scope = ComputeEffectiveScope(protectedResourceMetadata, authServerMetadata);
+        var authUrl = BuildAuthorizationUrl(protectedResourceMetadata, authServerMetadata, codeChallenge, state, scope);
+        _inFlightAuthorizationCodeFlowScopes = new HashSet<string>(scope is null ? [] : SplitScopes(scope), StringComparer.Ordinal);
 
         return CompleteAuthorizationCodeFlowAsync(protectedResourceMetadata, authServerMetadata, authUrl, state, codeVerifier, cancellationToken);
     }
@@ -848,7 +881,8 @@ private Uri BuildAuthorizationUrl(
         ProtectedResourceMetadata protectedResourceMetadata,
         AuthorizationServerMetadata authServerMetadata,
         string codeChallenge,
-        string state)
+        string state,
+        string? scope)
     {
         var resourceUri = GetResourceUri(protectedResourceMetadata);
 
@@ -867,7 +901,6 @@ private Uri BuildAuthorizationUrl(
             queryParamsDictionary["resource"] = resourceUri;
         }
 
-        var scope = ComputeEffectiveScope(protectedResourceMetadata, authServerMetadata);
         if (!string.IsNullOrEmpty(scope))
         {
             queryParamsDictionary["scope"] = scope!;
 
@@ -2507,6 +2507,32 @@ public async Task AuthorizationFlow_ScopeSelector_ReturningEmpty_OmitsScopeParam
         Assert.False(scopePresent);
     }
 
+    /// <summary>
+    /// An in-memory token cache that signals when tokens are first stored and can model an authorization
+    /// server that issues no refresh token by discarding it.
+    /// </summary>
+    private sealed class SignalingTokenCache(bool discardRefreshTokens = false) : ITokenCache
+    {
+        private TokenContainer? _tokens;
+
+        public TaskCompletionSource TokensStored { get; } = new(TaskCreationOptions.RunContinuationsAsynchronously);
+
+        public ValueTask StoreTokensAsync(TokenContainer tokens, CancellationToken cancellationToken)
+        {
+            if (discardRefreshTokens)
+            {
+                tokens.RefreshToken = null;
+            }
+
+            Volatile.Write(ref _tokens, tokens);
+            TokensStored.TrySetResult();
+            return default;
+        }
+
+        public ValueTask<TokenContainer?> GetTokensAsync(CancellationToken cancellationToken) =>
+            new(Volatile.Read(ref _tokens));
+    }
+
     private HttpClientTransport CreateOAuthTransport(
         Func<AuthorizationCallbackContext, CancellationToken, Task<ModelContextProtocol.Authentication.AuthorizationResult?>>?
             authorizationCallbackHandler = null) =>
@@ -2707,7 +2733,7 @@ public async Task InteractiveAuthorization_PendingFlowIsNotReusedForChallengeReq
             // front of the pipeline), while the challenge middleware below it needs the authenticated user.
             app.Use(async (context, next) =>
             {
-                if (context.Request.Path == "/.well-known/oauth-protected-resource" && Volatile.Read(ref writeChallengeRaised) == 1)
+                if (context.Request.Path.StartsWithSegments("/.well-known/oauth-protected-resource") && Volatile.Read(ref writeChallengeRaised) == 1)
                 {
                     writeChallengeBeingHandled.TrySetResult();
                 }
@@ -2848,7 +2874,7 @@ public async Task InteractiveAuthorization_RepeatedChallengeForSameScopes_JoinsP
             // needs the authenticated user.
             app.Use(async (context, next) =>
             {
-                if (context.Request.Path == "/.well-known/oauth-protected-resource" && Volatile.Read(ref readChallengesRaised) == 2)
+                if (context.Request.Path.StartsWithSegments("/.well-known/oauth-protected-resource") && Volatile.Read(ref readChallengesRaised) == 2)
                 {
                     secondChallengeBeingHandled.TrySetResult();
                 }
@@ -2946,6 +2972,80 @@ public async Task InteractiveAuthorization_RepeatedChallengeForSameScopes_JoinsP
         Assert.Equal(["mcp:tools", "files:read mcp:tools"], requestedScopes);
     }
 
+    [Fact]
+    public async Task InteractiveAuthorization_FlowCompletingDuringChallengeHandling_IsReusedNotRestarted()
+    {
+        // A detached flow can complete while a later challenge is already being handled, after that
+        // challenge re-checked the token cache on acquiring the lock but before it decides whether to
+        // join the flow. Its token must then be reused; starting a second flow would prompt the user
+        // again for a token that is already cached. With no refresh token available (the test
+        // authorization server always issues one, so the cache discards it), the cached access token
+        // is the only alternative to a second prompt.
+        var tokenCache = new SignalingTokenCache(discardRefreshTokens: true);
+        var handlerInvocations = 0;
+        var handlerEntered = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var completeAuthorization = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var secondConnectStarted = 0;
+
+        await using var app = await StartMcpServerAsync(configureMiddleware: app =>
+        {
+            // Fetching the protected resource metadata is the client's first step in handling a
+            // challenge. The authentication handler serves that document itself, so this observer must
+            // sit ahead of the authentication middleware (added explicitly below rather than
+            // auto-inserted at the front of the pipeline). Once the second connect's challenge fetches
+            // it, the user completes the first connect's flow, and the response is held back until that
+            // flow has stored its token, so the challenge finds the flow completed when it decides.
+            app.Use(async (context, next) =>
+            {
+                if (context.Request.Path.StartsWithSegments("/.well-known/oauth-protected-resource") && Volatile.Read(ref secondConnectStarted) == 1)
+                {
+                    completeAuthorization.TrySetResult();
+                    await tokenCache.TokensStored.Task.WaitAsync(TestConstants.DefaultTimeout, context.RequestAborted);
+                }
+
+                await next(context);
+            });
+
+            app.UseAuthentication();
+            app.UseAuthorization();
+        });
+
+        await using var transport = new HttpClientTransport(new()
+        {
+            Endpoint = new(McpServerUrl),
+            OAuth = new()
+            {
+                ClientId = "demo-client",
+                ClientSecret = "demo-secret",
+                RedirectUri = new Uri("http://localhost:1179/callback"),
+                TokenCache = tokenCache,
+                AuthorizationCallbackHandler = async (context, cancellationToken) =>
+                {
+                    Interlocked.Increment(ref handlerInvocations);
+                    handlerEntered.TrySetResult();
+                    await completeAuthorization.Task.WaitAsync(cancellationToken);
+                    return await HandleAuthorizationUrlAsync(context, cancellationToken);
+                },
+            },
+        }, HttpClient, LoggerFactory);
+
+        var clientOptions = new McpClientOptions { ProtocolVersion = "2025-06-18" };
+
+        using var firstConnectCts = CancellationTokenSource.CreateLinkedTokenSource(TestContext.Current.CancellationToken);
+        var firstConnect = McpClient.CreateAsync(
+            transport, clientOptions, loggerFactory: LoggerFactory, cancellationToken: firstConnectCts.Token);
+
+        await handlerEntered.Task.WaitAsync(TestContext.Current.CancellationToken);
+        firstConnectCts.Cancel();
+        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => firstConnect);
+
+        Volatile.Write(ref secondConnectStarted, 1);
+        await using var client = await McpClient.CreateAsync(
+            transport, clientOptions, loggerFactory: LoggerFactory, cancellationToken: TestContext.Current.CancellationToken);
+
+        Assert.Equal(1, handlerInvocations);
+    }
+
     [Fact]
     public async Task DisposingTransport_CancelsDetachedAuthorizationFlow()
     {