diff --git a/.changeset/guard-native-client-sync-ghost-tokens.md b/.changeset/guard-native-client-sync-ghost-tokens.md
new file mode 100644
index 00000000000..3b253dc8ab4
--- /dev/null
+++ b/.changeset/guard-native-client-sync-ghost-tokens.md
@@ -0,0 +1,5 @@
+---
+'@clerk/expo': patch
+---
+
+Fix signed-in sessions being dropped shortly after browser SSO on Android when the native SDK refreshes with a stale device token and receives a new anonymous client. The native-to-JS client sync now rejects a device token that belongs to a different client with no signed-in sessions, keeps the JS session active, and re-syncs the native SDK back to the JS client. Native client events that carry a stale device token are also ignored while a JS-to-native token sync is still in flight.
diff --git a/integration/templates/expo-native/App.tsx b/integration/templates/expo-native/App.tsx
index 2031e9b4512..7e38fa83949 100644
--- a/integration/templates/expo-native/App.tsx
+++ b/integration/templates/expo-native/App.tsx
@@ -5,6 +5,9 @@ import { tokenCache } from '@clerk/expo/token-cache';
 import { useState } from 'react';
 import { Button, Modal, StyleSheet, Text, View } from 'react-native';
 
+import { E2EControls } from './components/E2EControls';
+import { JsSignInForm } from './components/JsSignInForm';
+
 const publishableKey = process.env.EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY;
 
 if (!publishableKey) {
@@ -17,6 +20,7 @@ function NativeBuildFixture() {
   const { startGoogleAuthenticationFlow } = useSignInWithGoogle();
   const [isAuthOpen, setIsAuthOpen] = useState(false);
   const [googleResult, setGoogleResult] = useState<string | null>(null);
+  const [e2eStatus, setE2eStatus] = useState<string | null>(null);
 
   return (
     <View style={styles.container}>
@@ -45,6 +49,9 @@ function NativeBuildFixture() {
         />
       )}
       {googleResult && <Text testID='google-result'>{googleResult}</Text>}
+      {!isSignedIn && <JsSignInForm onStatus={setE2eStatus} />}
+      {isSignedIn && <E2EControls onStatus={setE2eStatus} />}
+      {e2eStatus && <Text testID='e2e-status'>{e2eStatus}</Text>}
       {isSignedIn && (
         <Button
           testID='sign-out-button'
@@ -79,7 +86,7 @@ export default function App() {
 const styles = StyleSheet.create({
   container: {
     flex: 1,
-    gap: 16,
+    gap: 12,
     justifyContent: 'center',
     padding: 24,
   },
diff --git a/integration/templates/expo-native/components/E2EControls.tsx b/integration/templates/expo-native/components/E2EControls.tsx
new file mode 100644
index 00000000000..e41e543dcd7
--- /dev/null
+++ b/integration/templates/expo-native/components/E2EControls.tsx
@@ -0,0 +1,58 @@
+import { useAuth } from '@clerk/expo';
+import { requireOptionalNativeModule } from 'expo';
+import { Button, StyleSheet, View } from 'react-native';
+
+// Fixture-local Maestro hook (modules/e2e-hooks); android-only, null elsewhere.
+const E2EHooks = requireOptionalNativeModule<{ corruptNativeDeviceToken(): Promise<boolean> }>('E2EHooks');
+
+/**
+ * Signed-in controls for the native-token-divergence regression flow.
+ */
+export function E2EControls({ onStatus }: { onStatus: (status: string | null) => void }) {
+  const { getToken } = useAuth({ treatPendingAsSignedOut: false });
+
+  const onCorruptNativeToken = async () => {
+    onStatus(null);
+    try {
+      const didCorrupt = await E2EHooks?.corruptNativeDeviceToken();
+      // Delay the marker so Maestro cannot race the native client event and
+      // the JS sync settling.
+      setTimeout(() => onStatus(didCorrupt ? 'corrupt-done' : 'corrupt-failed'), 3000);
+    } catch {
+      onStatus('corrupt-failed');
+    }
+  };
+
+  const onMintSessionToken = async () => {
+    onStatus(null);
+    try {
+      const token = await getToken({ skipCache: true });
+      onStatus(token ? 'token-ok' : 'token-empty');
+    } catch {
+      onStatus('token-error');
+    }
+  };
+
+  return (
+    <View style={styles.e2eRow}>
+      <Button
+        testID='e2e-corrupt-native-token-button'
+        title='Corrupt'
+        onPress={() => void onCorruptNativeToken()}
+      />
+      <Button
+        testID='e2e-refresh-token-button'
+        title='Mint'
+        onPress={() => void onMintSessionToken()}
+      />
+    </View>
+  );
+}
+
+const styles = StyleSheet.create({
+  e2eRow: {
+    flexDirection: 'row',
+    gap: 12,
+    justifyContent: 'space-between',
+  },
+});
diff --git a/integration/templates/expo-native/components/JsSignInForm.tsx b/integration/templates/expo-native/components/JsSignInForm.tsx
new file mode 100644
index 00000000000..00745cce6ce
--- /dev/null
+++ b/integration/templates/expo-native/components/JsSignInForm.tsx
@@ -0,0 +1,69 @@
+import { useSignIn } from '@clerk/expo';
+import { useState } from 'react';
+import { Button, StyleSheet, TextInput } from 'react-native';
+
+/**
+ * Headless JS-runtime sign-in so the JS client owns the session, which the
+ * native-token-divergence flow requires (the native AuthView would create the
+ * session on the native client instead).
+ */
+export function JsSignInForm({ onStatus }: { onStatus: (status: string) => void }) {
+  const { signIn } = useSignIn();
+  const [identifier, setIdentifier] = useState('');
+  const [password, setPassword] = useState('');
+
+  const onJsSignIn = async () => {
+    try {
+      const { error } = await signIn.password({ identifier, password });
+      if (error) {
+        onStatus(`sign-in-error ${error.message ?? ''}`.replace(/\s+/g, ' ').trim());
+        return;
+      }
+      const { error: finalizeError } = await signIn.finalize();
+      if (finalizeError) {
+        onStatus(`sign-in-error ${finalizeError.message ?? ''}`.replace(/\s+/g, ' ').trim());
+      }
+    } catch (error) {
+      onStatus(`sign-in-error ${String(error)}`.replace(/\s+/g, ' '));
+    }
+  };
+
+  return (
+    <>
+      <TextInput
+        testID='e2e-identifier-input'
+        style={styles.input}
+        autoCapitalize='none'
+        autoCorrect={false}
+        placeholder='e2e identifier'
+        value={identifier}
+        onChangeText={setIdentifier}
+      />
+      <TextInput
+        testID='e2e-password-input'
+        style={styles.input}
+        autoCapitalize='none'
+        autoCorrect={false}
+        secureTextEntry
+        placeholder='e2e secret'
+        value={password}
+        onChangeText={setPassword}
+      />
+      <Button
+        testID='e2e-js-sign-in-button'
+        title='E2E JS sign in'
+        onPress={() => void onJsSignIn()}
+      />
+    </>
+  );
+}
+
+const styles = StyleSheet.create({
+  input: {
+    borderColor: '#cccccc',
+    borderRadius: 6,
+    borderWidth: 1,
+    paddingHorizontal: 12,
+    paddingVertical: 8,
+  },
+});
diff --git a/integration/templates/expo-native/modules/e2e-hooks/android/build.gradle b/integration/templates/expo-native/modules/e2e-hooks/android/build.gradle
new file mode 100644
index 00000000000..15109126428
--- /dev/null
+++ b/integration/templates/expo-native/modules/e2e-hooks/android/build.gradle
@@ -0,0 +1,48 @@
+plugins {
+  id 'com.android.library'
+  id 'org.jetbrains.kotlin.android'
+}
+
+def expoModulesCorePlugin = new File(project(":expo-modules-core").projectDir.absolutePath, "ExpoModulesCorePlugin.gradle")
+apply from: expoModulesCorePlugin
+applyKotlinExpoModulesCorePlugin()
+
+group = 'com.clerk.e2ehooks'
+version = '1.0.0'
+
+def safeExtGet(prop, fallback) {
+  rootProject.ext.has(prop) ? rootProject.ext.get(prop) : fallback
+}
+
+android {
+  namespace "com.clerk.e2ehooks"
+
+  compileSdk safeExtGet("compileSdkVersion", 36)
+
+  defaultConfig {
+    minSdk safeExtGet("minSdkVersion", 24)
+    targetSdk safeExtGet("targetSdkVersion", 36)
+  }
+
+  compileOptions {
+    sourceCompatibility JavaVersion.VERSION_17
+    targetCompatibility JavaVersion.VERSION_17
+  }
+
+  kotlinOptions {
+    jvmTarget = "17"
+    // clerk-android metadata is Kotlin 2.3.x; Expo SDKs compile with 2.1.x.
+    freeCompilerArgs += ['-Xskip-metadata-version-check']
+  }
+}
+
+dependencies {
+  implementation project(':expo-modules-core')
+  implementation "org.jetbrains.kotlinx:kotlinx-coroutines-android:1.7.3"
+
+  // Provided at runtime by the @clerk/expo native module; keep versions in sync
+  // with packages/expo/android/build.gradle.
+  compileOnly("com.clerk:clerk-android-api:1.0.36") {
+    exclude group: 'org.jetbrains.kotlin', module: 'kotlin-stdlib'
+  }
+}
diff --git a/integration/templates/expo-native/modules/e2e-hooks/android/src/main/java/com/clerk/e2ehooks/E2EHooksModule.kt b/integration/templates/expo-native/modules/e2e-hooks/android/src/main/java/com/clerk/e2ehooks/E2EHooksModule.kt
new file mode 100644
index 00000000000..b4d1f265b9f
--- /dev/null
+++ b/integration/templates/expo-native/modules/e2e-hooks/android/src/main/java/com/clerk/e2ehooks/E2EHooksModule.kt
@@ -0,0 +1,35 @@
+package com.clerk.e2ehooks
+
+import com.clerk.api.Clerk
+import com.clerk.api.network.serialization.ClerkResult
+import expo.modules.kotlin.Promise
+import expo.modules.kotlin.modules.Module
+import expo.modules.kotlin.modules.ModuleDefinition
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
+
+/**
+ * Fixture-only Maestro hook. Never ship this in a real app.
+ */
+class E2EHooksModule : Module() {
+    private val coroutineScope = CoroutineScope(Dispatchers.Main)
+
+    override fun definition() = ModuleDefinition {
+        Name("E2EHooks")
+
+        // Reproduces the stale-token foreground refresh from MOBILE-594: replace
+        // the native device token with garbage and refresh, so the server hands
+        // native a brand-new session-less client whose token is emitted to JS.
+        AsyncFunction("corruptNativeDeviceToken") { promise: Promise ->
+            coroutineScope.launch {
+                try {
+                    val result = Clerk.updateDeviceToken("e2e-stale-device-token")
+                    promise.resolve(result is ClerkResult.Success)
+                } catch (e: Exception) {
+                    promise.reject("E_CORRUPT_FAILED", e.message, e)
+                }
+            }
+        }
+    }
+}
diff --git a/integration/templates/expo-native/modules/e2e-hooks/expo-module.config.json b/integration/templates/expo-native/modules/e2e-hooks/expo-module.config.json
new file mode 100644
index 00000000000..d74ca6d4a31
--- /dev/null
+++ b/integration/templates/expo-native/modules/e2e-hooks/expo-module.config.json
@@ -0,0 +1,6 @@
+{
+  "platforms": ["android"],
+  "android": {
+    "modules": ["com.clerk.e2ehooks.E2EHooksModule"]
+  }
+}
diff --git a/integration/tests/expo-native/flows/session-survives-native-token-divergence.yaml b/integration/tests/expo-native/flows/session-survives-native-token-divergence.yaml
new file mode 100644
index 00000000000..cb630bdb544
--- /dev/null
+++ b/integration/tests/expo-native/flows/session-survives-native-token-divergence.yaml
@@ -0,0 +1,44 @@
+# Regression for the lazily-persisted-clients incident (MOBILE-594): a stale
+# native refresh hands JS a token for a brand-new session-less client, and the
+# JS session must survive. Sign-in happens through the JS runtime (not the
+# native AuthView) so the JS client owns the session, which is the topology
+# the incident requires. Android-only: the corrupt hook lives in the fixture's
+# android E2EHooks module, so the flow no-ops on iOS.
+appId: com.clerk.exponativebuildfixture
+name: JS session survives a divergent native client token
+---
+- runFlow:
+    when:
+      platform: Android
+    commands:
+      - runFlow: subflows/open-app.yaml
+      - tapOn:
+          id: 'e2e-identifier-input'
+      - inputText: ${CLERK_TEST_EMAIL}
+      - tapOn:
+          id: 'e2e-password-input'
+      - inputText: ${CLERK_TEST_PASSWORD}
+      - hideKeyboard
+      - tapOn:
+          id: 'e2e-js-sign-in-button'
+      - runFlow: subflows/assert-signed-in.yaml
+      # Force the native SDK onto a stale token; its refresh emits a
+      # session-less client token to JS (the incident trigger). The fixture
+      # shows corrupt-done only after the sync had time to settle.
+      - tapOn:
+          id: 'e2e-corrupt-native-token-button'
+      - extendedWaitUntil:
+          visible: 'corrupt-done'
+          timeout: 30000
+      # Mint a session token with whatever the JS cache now holds. Without the
+      # adoption guard this fails and the session collapses (~44s in prod).
+      - tapOn:
+          id: 'e2e-refresh-token-button'
+      - extendedWaitUntil:
+          visible: 'token-ok'
+          timeout: 20000
+      - assertVisible: 'signed in'
+      # Leave the app signed out for whichever flow runs next.
+      - tapOn:
+          id: 'sign-out-button'
+      - runFlow: subflows/assert-signed-out.yaml
diff --git a/packages/expo/src/provider/__tests__/ClerkProvider.nativeClientSync.test.tsx b/packages/expo/src/provider/__tests__/ClerkProvider.nativeClientSync.test.tsx
index b6ae6bb8eef..8434bc68cb6 100644
--- a/packages/expo/src/provider/__tests__/ClerkProvider.nativeClientSync.test.tsx
+++ b/packages/expo/src/provider/__tests__/ClerkProvider.nativeClientSync.test.tsx
@@ -1302,4 +1302,419 @@ describe('ClerkProvider native client sync', () => {
       expect(mocks.syncClientStateFromJs).toHaveBeenCalledWith(null, expect.any(String), false, true);
     });
   });
+
+  test('rejects a foreign session-less native client token while JS is signed in and heals native', async () => {
+    const activeSession = {
+      id: 'session_1',
+      status: 'active',
+      user: { id: 'user_1' },
+    };
+    const ghostClient = {
+      id: 'client_ghost',
+      signedInSessions: [],
+      lastActiveSessionId: null,
+    };
+    const originalUpdateClient = mocks.clerkInstance.updateClient;
+
+    mocks.tokenCache.getToken.mockResolvedValue('js-client-token');
+    mocks.getClientToken.mockResolvedValue('js-client-token');
+    mocks.clerkInstance.client = {
+      id: 'client_js',
+      signedInSessions: [activeSession],
+      lastActiveSessionId: 'session_1',
+      fetch: vi.fn().mockResolvedValue(ghostClient),
+    };
+    mocks.clerkInstance.session = activeSession;
+
+    const { rerender } = render(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(mocks.configure).toHaveBeenCalled();
+    });
+
+    mocks.tokenCache.saveToken.mockClear();
+    mocks.syncClientStateFromJs.mockClear();
+    mocks.clerkInstance.__internal_reloadInitialResources.mockClear();
+
+    mocks.nativeClientEvent = {
+      issuedAt: 1,
+      changed: {
+        client: true,
+        deviceToken: true,
+      },
+      deviceToken: 'ghost-client-token',
+    };
+    rerender(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(mocks.tokenCache.saveToken).toHaveBeenCalledWith(CLERK_CLIENT_JWT_KEY, 'js-client-token');
+    });
+    expect(mocks.tokenCache.saveToken).toHaveBeenCalledWith(CLERK_CLIENT_JWT_KEY, 'ghost-client-token');
+    expect(originalUpdateClient).not.toHaveBeenCalledWith(ghostClient);
+    expect(originalUpdateClient).not.toHaveBeenCalledWith(ghostClient, expect.anything());
+    expect(mocks.clerkInstance.session).toBe(activeSession);
+    expect(mocks.clerkInstance.__internal_reloadInitialResources).not.toHaveBeenCalled();
+
+    await waitFor(() => {
+      expect(mocks.syncClientStateFromJs).toHaveBeenCalledWith('js-client-token', expect.any(String), false, true);
+    });
+  });
+
+  test('still signs JS out when the same client loses its signed-in sessions', async () => {
+    const activeSession = {
+      id: 'session_1',
+      status: 'active',
+      user: { id: 'user_1' },
+    };
+    const signedOutClient = {
+      id: 'client_shared',
+      signedInSessions: [],
+      lastActiveSessionId: null,
+    };
+    const originalUpdateClient = mocks.clerkInstance.updateClient;
+
+    mocks.tokenCache.getToken.mockResolvedValue('js-client-token');
+    mocks.getClientToken.mockResolvedValue('js-client-token');
+    mocks.clerkInstance.client = {
+      id: 'client_shared',
+      signedInSessions: [activeSession],
+      lastActiveSessionId: 'session_1',
+      fetch: vi.fn().mockResolvedValue(signedOutClient),
+    };
+    mocks.clerkInstance.session = activeSession;
+
+    const { rerender } = render(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(mocks.configure).toHaveBeenCalled();
+    });
+
+    mocks.syncClientStateFromJs.mockClear();
+
+    mocks.nativeClientEvent = {
+      issuedAt: 1,
+      changed: {
+        client: true,
+        deviceToken: false,
+      },
+      deviceToken: 'js-client-token',
+    };
+    rerender(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(originalUpdateClient).toHaveBeenCalledWith(signedOutClient);
+    });
+    expect(mocks.syncClientStateFromJs).not.toHaveBeenCalled();
+  });
+
+  test('adopts a different native client that has signed-in sessions', async () => {
+    const activeSession = {
+      id: 'session_1',
+      status: 'active',
+      user: { id: 'user_1' },
+    };
+    const nativeSession = {
+      id: 'session_2',
+      status: 'active',
+      user: { id: 'user_2' },
+    };
+    const nativeClient = {
+      id: 'client_native',
+      signedInSessions: [nativeSession],
+      lastActiveSessionId: 'session_2',
+    };
+    const originalUpdateClient = mocks.clerkInstance.updateClient;
+
+    mocks.tokenCache.getToken.mockResolvedValue('js-client-token');
+    mocks.getClientToken.mockResolvedValue('js-client-token');
+    mocks.clerkInstance.client = {
+      id: 'client_js',
+      signedInSessions: [activeSession],
+      lastActiveSessionId: 'session_1',
+      fetch: vi.fn().mockResolvedValue(nativeClient),
+    };
+    mocks.clerkInstance.session = activeSession;
+    mocks.clerkInstance.setActive.mockImplementation(({ session }) => {
+      mocks.clerkInstance.session = session;
+      return Promise.resolve();
+    });
+
+    const { rerender } = render(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(mocks.configure).toHaveBeenCalled();
+    });
+
+    mocks.tokenCache.saveToken.mockClear();
+    mocks.clerkInstance.setActive.mockClear();
+
+    mocks.nativeClientEvent = {
+      issuedAt: 1,
+      changed: {
+        client: true,
+        deviceToken: true,
+      },
+      deviceToken: 'native-client-token',
+    };
+    rerender(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(mocks.clerkInstance.setActive).toHaveBeenCalledWith({ session: nativeSession });
+    });
+    expect(originalUpdateClient).toHaveBeenCalledWith(nativeClient, { __internal_dangerouslySkipEmit: true });
+    expect(mocks.tokenCache.saveToken).toHaveBeenCalledWith(CLERK_CLIENT_JWT_KEY, 'native-client-token');
+    expect(mocks.tokenCache.saveToken).not.toHaveBeenCalledWith(CLERK_CLIENT_JWT_KEY, 'js-client-token');
+  });
+
+  test('ignores divergent native events while a JS-to-native device token push is in flight', async () => {
+    mocks.tokenCache.getToken.mockResolvedValue(null);
+    let resolveFirstSync: (() => void) | undefined;
+    mocks.syncClientStateFromJs.mockImplementationOnce(() => {
+      return new Promise<void>(resolve => {
+        resolveFirstSync = resolve;
+      });
+    });
+
+    const fetchSpy = vi.fn().mockResolvedValue({
+      id: 'client_ghost',
+      signedInSessions: [],
+      lastActiveSessionId: null,
+    });
+    mocks.clerkInstance.client = {
+      id: 'client_js',
+      signedInSessions: [],
+      lastActiveSessionId: null,
+      fetch: fetchSpy,
+    };
+
+    const { rerender } = render(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(mocks.configure).toHaveBeenCalledWith('pk_test_123', null);
+    });
+
+    await act(async () => {
+      await mocks.clerkOptions?.tokenCache?.saveToken(CLERK_CLIENT_JWT_KEY, 'rotated-client-token');
+    });
+
+    await waitFor(() => {
+      expect(mocks.syncClientStateFromJs).toHaveBeenCalledWith('rotated-client-token', expect.any(String), false, true);
+    });
+
+    mocks.tokenCache.saveToken.mockClear();
+    mocks.clerkInstance.__internal_reloadInitialResources.mockClear();
+
+    mocks.nativeClientEvent = {
+      issuedAt: 1,
+      changed: {
+        client: true,
+        deviceToken: true,
+      },
+      deviceToken: 'ghost-client-token',
+    };
+    rerender(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await act(async () => {});
+
+    expect(fetchSpy).not.toHaveBeenCalled();
+    expect(mocks.tokenCache.saveToken).not.toHaveBeenCalledWith(CLERK_CLIENT_JWT_KEY, 'ghost-client-token');
+    expect(mocks.clerkInstance.__internal_reloadInitialResources).not.toHaveBeenCalled();
+
+    await act(async () => {
+      resolveFirstSync?.();
+    });
+
+    mocks.nativeClientEvent = {
+      issuedAt: 2,
+      changed: {
+        client: true,
+        deviceToken: true,
+      },
+      deviceToken: 'ghost-client-token',
+    };
+    rerender(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(fetchSpy).toHaveBeenCalled();
+    });
+  });
+
+  test('processes native events again after a failed JS-to-native push settles', async () => {
+    mocks.tokenCache.getToken.mockResolvedValue(null);
+    let rejectFirstSync: ((error: Error) => void) | undefined;
+    mocks.syncClientStateFromJs.mockImplementationOnce(() => {
+      return new Promise((_resolve, reject) => {
+        rejectFirstSync = reject;
+      });
+    });
+
+    const fetchSpy = vi.fn().mockResolvedValue({
+      id: 'client_ghost',
+      signedInSessions: [],
+      lastActiveSessionId: null,
+    });
+    mocks.clerkInstance.client = {
+      id: 'client_js',
+      signedInSessions: [],
+      lastActiveSessionId: null,
+      fetch: fetchSpy,
+    };
+
+    const { rerender } = render(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(mocks.configure).toHaveBeenCalledWith('pk_test_123', null);
+    });
+
+    await act(async () => {
+      await mocks.clerkOptions?.tokenCache?.saveToken(CLERK_CLIENT_JWT_KEY, 'rotated-client-token');
+    });
+
+    await waitFor(() => {
+      expect(mocks.syncClientStateFromJs).toHaveBeenCalledWith('rotated-client-token', expect.any(String), false, true);
+    });
+
+    mocks.nativeClientEvent = {
+      issuedAt: 1,
+      changed: {
+        client: true,
+        deviceToken: true,
+      },
+      deviceToken: 'ghost-client-token',
+    };
+    rerender(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await act(async () => {});
+    expect(fetchSpy).not.toHaveBeenCalled();
+
+    await act(async () => {
+      rejectFirstSync?.(new Error('native sync failed'));
+    });
+
+    mocks.nativeClientEvent = {
+      issuedAt: 2,
+      changed: {
+        client: true,
+        deviceToken: true,
+      },
+      deviceToken: 'ghost-client-token',
+    };
+    rerender(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(fetchSpy).toHaveBeenCalled();
+    });
+  });
+
+  test('adopts a foreign session-less client while JS is signed out', async () => {
+    const ghostClient = {
+      id: 'client_ghost',
+      signedInSessions: [],
+      lastActiveSessionId: null,
+    };
+    const originalUpdateClient = mocks.clerkInstance.updateClient;
+
+    mocks.tokenCache.getToken.mockResolvedValue('js-client-token');
+    mocks.getClientToken.mockResolvedValue('js-client-token');
+    mocks.clerkInstance.client = {
+      id: 'client_js',
+      signedInSessions: [],
+      lastActiveSessionId: null,
+      fetch: vi.fn().mockResolvedValue(ghostClient),
+    };
+    mocks.clerkInstance.session = undefined;
+
+    const { rerender } = render(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(mocks.configure).toHaveBeenCalled();
+    });
+
+    mocks.syncClientStateFromJs.mockClear();
+
+    mocks.nativeClientEvent = {
+      issuedAt: 1,
+      changed: {
+        client: true,
+        deviceToken: true,
+      },
+      deviceToken: 'ghost-client-token',
+    };
+    rerender(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(originalUpdateClient).toHaveBeenCalledWith(ghostClient);
+    });
+    expect(mocks.syncClientStateFromJs).not.toHaveBeenCalled();
+  });
 });
diff --git a/packages/expo/src/provider/nativeClientSync.tsx b/packages/expo/src/provider/nativeClientSync.tsx
index 1f50aa0699e..4047257a7bb 100644
--- a/packages/expo/src/provider/nativeClientSync.tsx
+++ b/packages/expo/src/provider/nativeClientSync.tsx
@@ -40,6 +40,7 @@ type NativeRefreshFromJsOptions = {
 
 export type NativeRefreshFromJsController = {
   cancel: () => void;
+  getInFlightDeviceTokenPush?: () => { deviceToken: string | null } | null;
 };
 
 export type DeviceTokenCacheListener = (deviceToken: string | null) => void;
@@ -204,22 +205,32 @@ function getDefaultSignedInSession(client: ClientResource | null | undefined): S
   return client.signedInSessions[0] ?? null;
 }
 
-async function refreshJsClientFromServer(clerkInstance: SyncableClerkInstance): Promise<ClientResource | null> {
+async function fetchRefreshedJsClient(clerkInstance: SyncableClerkInstance): Promise<ClientResource | null> {
   const client = clerkInstance.client as RefreshableClientResource | undefined;
 
   if (typeof client?.fetch !== 'function' || typeof clerkInstance.updateClient !== 'function') {
     return null;
   }
 
-  const refreshedClient = await client.fetch({ fetchMaxTries: 1 });
-  clerkInstance.updateClient(refreshedClient);
+  return client.fetch({ fetchMaxTries: 1 });
+}
 
-  return refreshedClient;
+function isForeignSessionlessClient(
+  previousClient: ClientResource | null | undefined,
+  refreshedClient: ClientResource,
+): boolean {
+  if (!previousClient?.id || !refreshedClient.id || previousClient.id === refreshedClient.id) {
+    return false;
+  }
+
+  return Boolean(getDefaultSignedInSession(previousClient)) && refreshedClient.signedInSessions.length === 0;
 }
 
 async function refreshJsClientFromNativeState({
   clerkInstance,
   nativeDeviceToken,
+  previousDeviceToken,
+  rejectForeignSessionlessClient = false,
   reloadInitialResources,
   shouldSyncDeviceToken = true,
   suppressTokenCacheNotificationsRef,
@@ -227,11 +238,15 @@ async function refreshJsClientFromNativeState({
 }: {
   clerkInstance: SyncableClerkInstance;
   nativeDeviceToken: string | null;
+  previousDeviceToken?: string | null;
+  rejectForeignSessionlessClient?: boolean;
   reloadInitialResources: boolean;
   shouldSyncDeviceToken?: boolean;
   suppressTokenCacheNotificationsRef?: MutableRefObject<number>;
   tokenCache: TokenCache | undefined;
 }): Promise<boolean> {
+  const previousClient = clerkInstance.client;
+
   if (shouldSyncDeviceToken) {
     await syncNativeDeviceTokenToCache({
       deviceToken: nativeDeviceToken,
@@ -240,8 +255,17 @@ async function refreshJsClientFromNativeState({
     });
   }
 
-  const refreshedClient = await refreshJsClientFromServer(clerkInstance);
+  const refreshedClient = await fetchRefreshedJsClient(clerkInstance);
   if (refreshedClient) {
+    if (rejectForeignSessionlessClient && isForeignSessionlessClient(previousClient, refreshedClient)) {
+      // Restoring the previous token also notifies native to re-sync to it.
+      if (shouldSyncDeviceToken && previousDeviceToken !== undefined) {
+        await syncDeviceTokenToCache(tokenCache, previousDeviceToken);
+      }
+      return true;
+    }
+
+    clerkInstance.updateClient?.(refreshedClient);
     await reconcileJsActiveSessionFromClient({
       clerkInstance,
     });
@@ -434,12 +458,16 @@ async function syncNativeClientToJs({
     return;
   }
 
+  const previousDeviceToken = didChangeDeviceToken ? await getCachedDeviceToken(tokenCache) : undefined;
+
   await runWithSuppressedJsClientChanges(suppressJsClientChangedRef, async () => {
     nativeRefreshFromJsControllerRef?.current?.cancel();
 
     await refreshJsClientFromNativeState({
       clerkInstance,
       nativeDeviceToken,
+      previousDeviceToken,
+      rejectForeignSessionlessClient: true,
       reloadInitialResources: true,
       shouldSyncDeviceToken: didChangeDeviceToken,
       suppressTokenCacheNotificationsRef,
@@ -476,6 +504,7 @@ export function NativeClientSync({
   const pendingNativeRefreshRef = useRef<NativeRefreshFromJsOptions | null>(null);
   const pendingNativeRefreshBeforeReadyRef = useRef<NativeRefreshFromJsOptions | null>(null);
   const nativeRefreshGenerationRef = useRef(0);
+  const inFlightDeviceTokenPushRef = useRef<{ deviceToken: string | null } | null>(null);
   const enabledRef = useRef(enabled);
   enabledRef.current = enabled;
 
@@ -484,11 +513,17 @@ export function NativeClientSync({
     pendingNativeRefreshBeforeReadyRef.current = null;
     nativeRefreshGenerationRef.current += 1;
     isRefreshingNativeFromJsRef.current = false;
+    inFlightDeviceTokenPushRef.current = null;
+  }, []);
+
+  const getInFlightDeviceTokenPush = useCallback(() => {
+    return isRefreshingNativeFromJsRef.current ? inFlightDeviceTokenPushRef.current : null;
   }, []);
 
   useEffect(() => {
     nativeRefreshFromJsControllerRef.current = {
       cancel: cancelNativeRefreshFromJs,
+      getInFlightDeviceTokenPush,
     };
 
     return () => {
@@ -496,7 +531,7 @@ export function NativeClientSync({
         nativeRefreshFromJsControllerRef.current = null;
       }
     };
-  }, [cancelNativeRefreshFromJs, nativeRefreshFromJsControllerRef]);
+  }, [cancelNativeRefreshFromJs, getInFlightDeviceTokenPush, nativeRefreshFromJsControllerRef]);
 
   useEffect(() => {
     if (
@@ -563,15 +598,23 @@ export function NativeClientSync({
   }, [clerkInstance, suppressJsClientChangedRef]);
 
   const queueNativeRefreshFromJs = useCallback((options: NativeRefreshFromJsOptions): void => {
+    const trackInFlightDeviceTokenPush = (pushOptions: NativeRefreshFromJsOptions) => {
+      if (pushOptions.didChangeDeviceToken) {
+        inFlightDeviceTokenPushRef.current = { deviceToken: pushOptions.deviceToken ?? null };
+      }
+    };
+
     if (isRefreshingNativeFromJsRef.current) {
       pendingNativeRefreshRef.current = mergePendingNativeRefreshOptions(pendingNativeRefreshRef.current, options);
       nativeRefreshGenerationRef.current += 1;
+      trackInFlightDeviceTokenPush(pendingNativeRefreshRef.current);
       return;
     }
 
     const initialGeneration = nativeRefreshGenerationRef.current + 1;
     nativeRefreshGenerationRef.current = initialGeneration;
     isRefreshingNativeFromJsRef.current = true;
+    trackInFlightDeviceTokenPush(options);
 
     const refreshNativeFromJsClient = async (
       options: NativeRefreshFromJsOptions,
@@ -623,6 +666,7 @@ export function NativeClientSync({
     })().finally(() => {
       if (latestRunGeneration === nativeRefreshGenerationRef.current || pendingNativeRefreshRef.current === null) {
         isRefreshingNativeFromJsRef.current = false;
+        inFlightDeviceTokenPushRef.current = null;
       }
     });
   }, []);
@@ -969,6 +1013,13 @@ export function useNativeClientEventSync({
       return;
     }
 
+    const inFlightDeviceTokenPush = nativeRefreshFromJsControllerRef.current?.getInFlightDeviceTokenPush?.();
+    if (inFlightDeviceTokenPush && nativeClientEvent.deviceToken !== inFlightDeviceTokenPush.deviceToken) {
+      // The event was computed before the device token JS is currently pushing
+      // to native; that push realigns native, so the stale token must not win.
+      return;
+    }
+
     const syncNativeClientStateToJs = async () => {
       try {
         if (!isMountedRef.current) {