diff --git a/.changeset/protect-expo-native-client-sync.md b/.changeset/protect-expo-native-client-sync.md
new file mode 100644
index 00000000000..56cab5fb812
--- /dev/null
+++ b/.changeset/protect-expo-native-client-sync.md
@@ -0,0 +1,5 @@
+---
+'@clerk/expo': patch
+---
+
+Prevent native client updates from replacing a signed-in Expo client with a stale or sessionless client. Native-to-JS synchronization now validates client changes before applying them, restores the previous token when validation fails, and applies the same protection during 401 recovery.
diff --git a/integration/templates/expo-native/App.tsx b/integration/templates/expo-native/App.tsx
index 2031e9b4512..cef3f2faf71 100644
--- a/integration/templates/expo-native/App.tsx
+++ b/integration/templates/expo-native/App.tsx
@@ -1,10 +1,13 @@
 import { ClerkProvider, useAuth, useUser } from '@clerk/expo';
-import { useSignInWithGoogle } from '@clerk/expo/google';
 import { AuthView, UserButton } from '@clerk/expo/native';
 import { tokenCache } from '@clerk/expo/token-cache';
 import { useState } from 'react';
 import { Button, Modal, StyleSheet, Text, View } from 'react-native';
 
+import { E2EControls } from './components/E2EControls';
+import { GoogleSignInButton } from './components/GoogleSignInButton';
+import { JsSignInForm } from './components/JsSignInForm';
+
 const publishableKey = process.env.EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY;
 
 if (!publishableKey) {
@@ -14,9 +17,8 @@ if (!publishableKey) {
 function NativeBuildFixture() {
   const { isLoaded, isSignedIn, signOut } = useAuth({ treatPendingAsSignedOut: false });
   const { user } = useUser();
-  const { startGoogleAuthenticationFlow } = useSignInWithGoogle();
   const [isAuthOpen, setIsAuthOpen] = useState(false);
-  const [googleResult, setGoogleResult] = useState<string | null>(null);
+  const [e2eStatus, setE2eStatus] = useState<string | null>(null);
 
   return (
     <View style={styles.container}>
@@ -32,19 +34,10 @@ function NativeBuildFixture() {
         title='Open native AuthView'
         onPress={() => setIsAuthOpen(true)}
       />
-      {!isSignedIn && (
-        <Button
-          testID='google-sign-in-button'
-          title='Sign in with Google'
-          onPress={() => {
-            void startGoogleAuthenticationFlow().catch((error: unknown) => {
-              const message = error instanceof Error ? error.message : String(error);
-              setGoogleResult(message.replace(/\s+/g, ' '));
-            });
-          }}
-        />
-      )}
-      {googleResult && <Text testID='google-result'>{googleResult}</Text>}
+      {!isSignedIn && <GoogleSignInButton />}
+      {!isSignedIn && <JsSignInForm onStatus={setE2eStatus} />}
+      {isSignedIn && <E2EControls onStatus={setE2eStatus} />}
+      {e2eStatus && <Text testID='e2e-status'>{e2eStatus}</Text>}
       {isSignedIn && (
         <Button
           testID='sign-out-button'
@@ -79,7 +72,7 @@ export default function App() {
 const styles = StyleSheet.create({
   container: {
     flex: 1,
-    gap: 16,
+    gap: 12,
     justifyContent: 'center',
     padding: 24,
   },
diff --git a/integration/templates/expo-native/components/E2EControls.tsx b/integration/templates/expo-native/components/E2EControls.tsx
new file mode 100644
index 00000000000..85baa755fc6
--- /dev/null
+++ b/integration/templates/expo-native/components/E2EControls.tsx
@@ -0,0 +1,57 @@
+import { useAuth } from '@clerk/expo';
+import { requireOptionalNativeModule } from 'expo';
+import { Button, StyleSheet, View } from 'react-native';
+
+// Fixture-local Maestro hook (modules/e2e-hooks); android-only, null elsewhere.
+const E2EHooks = requireOptionalNativeModule<{ corruptNativeDeviceToken(): Promise<boolean> }>('E2EHooks');
+
+/**
+ * Signed-in controls for the native-token-divergence regression flow.
+ */
+export function E2EControls({ onStatus }: { onStatus: (status: string | null) => void }) {
+  const { getToken } = useAuth({ treatPendingAsSignedOut: false });
+
+  const onCorruptNativeToken = async () => {
+    onStatus(null);
+    try {
+      const didCorrupt = await E2EHooks?.corruptNativeDeviceToken();
+      // Delayed so Maestro cannot race the native event and the JS sync settling.
+      setTimeout(() => onStatus(didCorrupt ? 'corrupt-done' : 'corrupt-failed'), 3000);
+    } catch {
+      onStatus('corrupt-failed');
+    }
+  };
+
+  const onMintSessionToken = async () => {
+    onStatus(null);
+    try {
+      const token = await getToken({ skipCache: true });
+      onStatus(token ? 'token-ok' : 'token-empty');
+    } catch {
+      onStatus('token-error');
+    }
+  };
+
+  return (
+    <View style={styles.e2eRow}>
+      <Button
+        testID='e2e-corrupt-native-token-button'
+        title='Corrupt'
+        onPress={() => void onCorruptNativeToken()}
+      />
+      <Button
+        testID='e2e-refresh-token-button'
+        title='Mint'
+        onPress={() => void onMintSessionToken()}
+      />
+    </View>
+  );
+}
+
+const styles = StyleSheet.create({
+  e2eRow: {
+    flexDirection: 'row',
+    gap: 12,
+    justifyContent: 'space-between',
+  },
+});
diff --git a/integration/templates/expo-native/components/GoogleSignInButton.tsx b/integration/templates/expo-native/components/GoogleSignInButton.tsx
new file mode 100644
index 00000000000..61b3df286fd
--- /dev/null
+++ b/integration/templates/expo-native/components/GoogleSignInButton.tsx
@@ -0,0 +1,24 @@
+import { useSignInWithGoogle } from '@clerk/expo/google';
+import { useState } from 'react';
+import { Button, Text } from 'react-native';
+
+export function GoogleSignInButton() {
+  const { startGoogleAuthenticationFlow } = useSignInWithGoogle();
+  const [result, setResult] = useState<string | null>(null);
+
+  return (
+    <>
+      <Button
+        testID='google-sign-in-button'
+        title='Sign in with Google'
+        onPress={() => {
+          void startGoogleAuthenticationFlow().catch((error: unknown) => {
+            const message = error instanceof Error ? error.message : String(error);
+            setResult(message.replace(/\s+/g, ' '));
+          });
+        }}
+      />
+      {result && <Text testID='google-result'>{result}</Text>}
+    </>
+  );
+}
diff --git a/integration/templates/expo-native/components/JsSignInForm.tsx b/integration/templates/expo-native/components/JsSignInForm.tsx
new file mode 100644
index 00000000000..5a76cb98cae
--- /dev/null
+++ b/integration/templates/expo-native/components/JsSignInForm.tsx
@@ -0,0 +1,71 @@
+import { useSignIn } from '@clerk/expo';
+import { useState } from 'react';
+import { Button, StyleSheet, TextInput } from 'react-native';
+
+/**
+ * Headless JS-runtime sign-in so the JS client owns the session, which the
+ * native-token-divergence flow requires (the native AuthView would create the
+ * session on the native client instead).
+ */
+export function JsSignInForm({ onStatus }: { onStatus: (status: string) => void }) {
+  const { signIn } = useSignIn();
+  const [identifier, setIdentifier] = useState('');
+  const [password, setPassword] = useState('');
+
+  const reportError = (message: string) => onStatus(`sign-in-error ${message}`.replace(/\s+/g, ' ').trim());
+
+  const onJsSignIn = async () => {
+    try {
+      const { error } = await signIn.password({ identifier, password });
+      if (error) {
+        reportError(error.message ?? '');
+        return;
+      }
+      const { error: finalizeError } = await signIn.finalize();
+      if (finalizeError) {
+        reportError(finalizeError.message ?? '');
+      }
+    } catch (error) {
+      reportError(String(error));
+    }
+  };
+
+  return (
+    <>
+      <TextInput
+        testID='e2e-identifier-input'
+        style={styles.input}
+        autoCapitalize='none'
+        autoCorrect={false}
+        placeholder='e2e identifier'
+        value={identifier}
+        onChangeText={setIdentifier}
+      />
+      <TextInput
+        testID='e2e-password-input'
+        style={styles.input}
+        autoCapitalize='none'
+        autoCorrect={false}
+        secureTextEntry
+        placeholder='e2e secret'
+        value={password}
+        onChangeText={setPassword}
+      />
+      <Button
+        testID='e2e-js-sign-in-button'
+        title='E2E JS sign in'
+        onPress={() => void onJsSignIn()}
+      />
+    </>
+  );
+}
+
+const styles = StyleSheet.create({
+  input: {
+    borderColor: '#cccccc',
+    borderRadius: 6,
+    borderWidth: 1,
+    paddingHorizontal: 12,
+    paddingVertical: 8,
+  },
+});
diff --git a/integration/templates/expo-native/modules/e2e-hooks/android/build.gradle b/integration/templates/expo-native/modules/e2e-hooks/android/build.gradle
new file mode 100644
index 00000000000..15109126428
--- /dev/null
+++ b/integration/templates/expo-native/modules/e2e-hooks/android/build.gradle
@@ -0,0 +1,48 @@
+plugins {
+  id 'com.android.library'
+  id 'org.jetbrains.kotlin.android'
+}
+
+def expoModulesCorePlugin = new File(project(":expo-modules-core").projectDir.absolutePath, "ExpoModulesCorePlugin.gradle")
+apply from: expoModulesCorePlugin
+applyKotlinExpoModulesCorePlugin()
+
+group = 'com.clerk.e2ehooks'
+version = '1.0.0'
+
+def safeExtGet(prop, fallback) {
+  rootProject.ext.has(prop) ? rootProject.ext.get(prop) : fallback
+}
+
+android {
+  namespace "com.clerk.e2ehooks"
+
+  compileSdk safeExtGet("compileSdkVersion", 36)
+
+  defaultConfig {
+    minSdk safeExtGet("minSdkVersion", 24)
+    targetSdk safeExtGet("targetSdkVersion", 36)
+  }
+
+  compileOptions {
+    sourceCompatibility JavaVersion.VERSION_17
+    targetCompatibility JavaVersion.VERSION_17
+  }
+
+  kotlinOptions {
+    jvmTarget = "17"
+    // clerk-android metadata is Kotlin 2.3.x; Expo SDKs compile with 2.1.x.
+    freeCompilerArgs += ['-Xskip-metadata-version-check']
+  }
+}
+
+dependencies {
+  implementation project(':expo-modules-core')
+  implementation "org.jetbrains.kotlinx:kotlinx-coroutines-android:1.7.3"
+
+  // Provided at runtime by the @clerk/expo native module; keep versions in sync
+  // with packages/expo/android/build.gradle.
+  compileOnly("com.clerk:clerk-android-api:1.0.36") {
+    exclude group: 'org.jetbrains.kotlin', module: 'kotlin-stdlib'
+  }
+}
diff --git a/integration/templates/expo-native/modules/e2e-hooks/android/src/main/java/com/clerk/e2ehooks/E2EHooksModule.kt b/integration/templates/expo-native/modules/e2e-hooks/android/src/main/java/com/clerk/e2ehooks/E2EHooksModule.kt
new file mode 100644
index 00000000000..b4d1f265b9f
--- /dev/null
+++ b/integration/templates/expo-native/modules/e2e-hooks/android/src/main/java/com/clerk/e2ehooks/E2EHooksModule.kt
@@ -0,0 +1,35 @@
+package com.clerk.e2ehooks
+
+import com.clerk.api.Clerk
+import com.clerk.api.network.serialization.ClerkResult
+import expo.modules.kotlin.Promise
+import expo.modules.kotlin.modules.Module
+import expo.modules.kotlin.modules.ModuleDefinition
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
+
+/**
+ * Fixture-only Maestro hook. Never ship this in a real app.
+ */
+class E2EHooksModule : Module() {
+    private val coroutineScope = CoroutineScope(Dispatchers.Main)
+
+    override fun definition() = ModuleDefinition {
+        Name("E2EHooks")
+
+        // Reproduces the stale-token foreground refresh from MOBILE-594: replace
+        // the native device token with garbage and refresh, so the server hands
+        // native a brand-new session-less client whose token is emitted to JS.
+        AsyncFunction("corruptNativeDeviceToken") { promise: Promise ->
+            coroutineScope.launch {
+                try {
+                    val result = Clerk.updateDeviceToken("e2e-stale-device-token")
+                    promise.resolve(result is ClerkResult.Success)
+                } catch (e: Exception) {
+                    promise.reject("E_CORRUPT_FAILED", e.message, e)
+                }
+            }
+        }
+    }
+}
diff --git a/integration/templates/expo-native/modules/e2e-hooks/expo-module.config.json b/integration/templates/expo-native/modules/e2e-hooks/expo-module.config.json
new file mode 100644
index 00000000000..d74ca6d4a31
--- /dev/null
+++ b/integration/templates/expo-native/modules/e2e-hooks/expo-module.config.json
@@ -0,0 +1,6 @@
+{
+  "platforms": ["android"],
+  "android": {
+    "modules": ["com.clerk.e2ehooks.E2EHooksModule"]
+  }
+}
diff --git a/integration/tests/expo-native/flows/session-survives-native-token-divergence.yaml b/integration/tests/expo-native/flows/session-survives-native-token-divergence.yaml
new file mode 100644
index 00000000000..cb630bdb544
--- /dev/null
+++ b/integration/tests/expo-native/flows/session-survives-native-token-divergence.yaml
@@ -0,0 +1,44 @@
+# Regression for the lazily-persisted-clients incident (MOBILE-594): a stale
+# native refresh hands JS a token for a brand-new session-less client, and the
+# JS session must survive. Sign-in happens through the JS runtime (not the
+# native AuthView) so the JS client owns the session, which is the topology
+# the incident requires. Android-only: the corrupt hook lives in the fixture's
+# android E2EHooks module, so the flow no-ops on iOS.
+appId: com.clerk.exponativebuildfixture
+name: JS session survives a divergent native client token
+---
+- runFlow:
+    when:
+      platform: Android
+    commands:
+      - runFlow: subflows/open-app.yaml
+      - tapOn:
+          id: 'e2e-identifier-input'
+      - inputText: ${CLERK_TEST_EMAIL}
+      - tapOn:
+          id: 'e2e-password-input'
+      - inputText: ${CLERK_TEST_PASSWORD}
+      - hideKeyboard
+      - tapOn:
+          id: 'e2e-js-sign-in-button'
+      - runFlow: subflows/assert-signed-in.yaml
+      # Force the native SDK onto a stale token; its refresh emits a
+      # session-less client token to JS (the incident trigger). The fixture
+      # shows corrupt-done only after the sync had time to settle.
+      - tapOn:
+          id: 'e2e-corrupt-native-token-button'
+      - extendedWaitUntil:
+          visible: 'corrupt-done'
+          timeout: 30000
+      # Mint a session token with whatever the JS cache now holds. Without the
+      # adoption guard this fails and the session collapses (~44s in prod).
+      - tapOn:
+          id: 'e2e-refresh-token-button'
+      - extendedWaitUntil:
+          visible: 'token-ok'
+          timeout: 20000
+      - assertVisible: 'signed in'
+      # Leave the app signed out for whichever flow runs next.
+      - tapOn:
+          id: 'sign-out-button'
+      - runFlow: subflows/assert-signed-out.yaml
diff --git a/packages/expo/src/provider/__tests__/ClerkProvider.nativeClientSync.test.tsx b/packages/expo/src/provider/__tests__/ClerkProvider.nativeClientSync.test.tsx
index b6ae6bb8eef..32e6ec97215 100644
--- a/packages/expo/src/provider/__tests__/ClerkProvider.nativeClientSync.test.tsx
+++ b/packages/expo/src/provider/__tests__/ClerkProvider.nativeClientSync.test.tsx
@@ -1302,4 +1302,361 @@ describe('ClerkProvider native client sync', () => {
       expect(mocks.syncClientStateFromJs).toHaveBeenCalledWith(null, expect.any(String), false, true);
     });
   });
+
+  test('rejects a foreign session-less native client and restores the signed-in JS token', async () => {
+    const jsDeviceToken = 'js-device-token';
+    const nativeDeviceToken = 'native-device-token';
+    const activeSession = {
+      id: 'session_1',
+      status: 'active',
+      user: { id: 'user_1' },
+    };
+    const foreignClient = {
+      id: 'client_foreign',
+      signedInSessions: [],
+      lastActiveSessionId: null,
+    };
+    const updateClient = mocks.clerkInstance.updateClient;
+
+    mocks.tokenCache.getToken.mockResolvedValue(jsDeviceToken);
+    mocks.getClientToken.mockResolvedValue(jsDeviceToken);
+    mocks.clerkInstance.client = {
+      id: 'client_js',
+      signedInSessions: [activeSession],
+      lastActiveSessionId: activeSession.id,
+      fetch: vi.fn().mockResolvedValue(foreignClient),
+    };
+    mocks.clerkInstance.session = activeSession;
+
+    const { rerender } = render(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(mocks.configure).toHaveBeenCalledWith('pk_test_123', jsDeviceToken);
+    });
+
+    mocks.syncClientStateFromJs.mockClear();
+    mocks.tokenCache.saveToken.mockClear();
+
+    mocks.nativeClientEvent = {
+      issuedAt: 1,
+      changed: {
+        client: true,
+        deviceToken: true,
+      },
+      deviceToken: nativeDeviceToken,
+    };
+    rerender(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(mocks.tokenCache.saveToken).toHaveBeenCalledWith(CLERK_CLIENT_JWT_KEY, jsDeviceToken);
+    });
+    expect(mocks.tokenCache.saveToken).toHaveBeenCalledWith(CLERK_CLIENT_JWT_KEY, nativeDeviceToken);
+    expect(updateClient).not.toHaveBeenCalledWith(foreignClient);
+    expect(mocks.clerkInstance.session).toBe(activeSession);
+
+    await waitFor(() => {
+      expect(mocks.syncClientStateFromJs).toHaveBeenCalledWith(jsDeviceToken, expect.any(String), false, true);
+    });
+  });
+
+  test('restores the signed-in JS token when native client verification fails', async () => {
+    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+    const jsDeviceToken = 'js-device-token';
+    const nativeDeviceToken = 'native-device-token';
+    const activeSession = {
+      id: 'session_1',
+      status: 'active',
+      user: { id: 'user_1' },
+    };
+
+    mocks.tokenCache.getToken.mockResolvedValue(jsDeviceToken);
+    mocks.getClientToken.mockResolvedValue(jsDeviceToken);
+    mocks.clerkInstance.client = {
+      id: 'client_js',
+      signedInSessions: [activeSession],
+      lastActiveSessionId: activeSession.id,
+      fetch: vi.fn().mockRejectedValue(new Error('verification failed')),
+    };
+    mocks.clerkInstance.session = activeSession;
+
+    const { rerender } = render(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(mocks.configure).toHaveBeenCalledWith('pk_test_123', jsDeviceToken);
+    });
+
+    mocks.syncClientStateFromJs.mockClear();
+    mocks.tokenCache.saveToken.mockClear();
+
+    mocks.nativeClientEvent = {
+      issuedAt: 1,
+      changed: {
+        client: true,
+        deviceToken: true,
+      },
+      deviceToken: nativeDeviceToken,
+    };
+    rerender(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(mocks.tokenCache.saveToken).toHaveBeenCalledWith(CLERK_CLIENT_JWT_KEY, jsDeviceToken);
+    });
+    expect(mocks.clerkInstance.session).toBe(activeSession);
+
+    await waitFor(() => {
+      expect(mocks.syncClientStateFromJs).toHaveBeenCalledWith(jsDeviceToken, expect.any(String), false, true);
+    });
+
+    consoleError.mockRestore();
+  });
+
+  test('does not replace a signed-in JS token when the native client cannot be verified', async () => {
+    const jsDeviceToken = 'js-device-token';
+    const nativeDeviceToken = 'native-device-token';
+    const activeSession = {
+      id: 'session_1',
+      status: 'active',
+      user: { id: 'user_1' },
+    };
+
+    mocks.tokenCache.getToken.mockResolvedValue(jsDeviceToken);
+    mocks.getClientToken.mockResolvedValue(jsDeviceToken);
+    mocks.clerkInstance.client = {
+      id: 'client_js',
+      signedInSessions: [activeSession],
+      lastActiveSessionId: activeSession.id,
+    };
+    mocks.clerkInstance.session = activeSession;
+
+    const { rerender } = render(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(mocks.configure).toHaveBeenCalledWith('pk_test_123', jsDeviceToken);
+    });
+
+    mocks.syncClientStateFromJs.mockClear();
+    mocks.tokenCache.saveToken.mockClear();
+    mocks.clerkInstance.__internal_reloadInitialResources.mockClear();
+
+    mocks.nativeClientEvent = {
+      issuedAt: 1,
+      changed: {
+        client: true,
+        deviceToken: true,
+      },
+      deviceToken: nativeDeviceToken,
+    };
+    rerender(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(mocks.syncClientStateFromJs).toHaveBeenCalledWith(jsDeviceToken, expect.any(String), false, true);
+    });
+    expect(mocks.tokenCache.saveToken).not.toHaveBeenCalledWith(CLERK_CLIENT_JWT_KEY, nativeDeviceToken);
+    expect(mocks.clerkInstance.__internal_reloadInitialResources).not.toHaveBeenCalled();
+    expect(mocks.clerkInstance.session).toBe(activeSession);
+  });
+
+  test('applies a session-less native response when it belongs to the current JS client', async () => {
+    const jsDeviceToken = 'js-device-token';
+    const nativeDeviceToken = 'native-device-token';
+    const activeSession = {
+      id: 'session_1',
+      status: 'active',
+      user: { id: 'user_1' },
+    };
+    const signedOutClient = {
+      id: 'client_shared',
+      signedInSessions: [],
+      lastActiveSessionId: null,
+    };
+    const updateClient = mocks.clerkInstance.updateClient;
+
+    mocks.tokenCache.getToken.mockResolvedValue(jsDeviceToken);
+    mocks.getClientToken.mockResolvedValue(jsDeviceToken);
+    mocks.clerkInstance.client = {
+      id: 'client_shared',
+      signedInSessions: [activeSession],
+      lastActiveSessionId: activeSession.id,
+      fetch: vi.fn().mockResolvedValue(signedOutClient),
+    };
+    mocks.clerkInstance.session = activeSession;
+
+    const { rerender } = render(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(mocks.configure).toHaveBeenCalledWith('pk_test_123', jsDeviceToken);
+    });
+
+    mocks.tokenCache.saveToken.mockClear();
+
+    mocks.nativeClientEvent = {
+      issuedAt: 1,
+      changed: {
+        client: true,
+        deviceToken: true,
+      },
+      deviceToken: nativeDeviceToken,
+    };
+    rerender(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(updateClient).toHaveBeenCalledWith(signedOutClient);
+    });
+    expect(mocks.tokenCache.saveToken).not.toHaveBeenCalledWith(CLERK_CLIENT_JWT_KEY, jsDeviceToken);
+    expect(mocks.clerkInstance.session).toBeNull();
+  });
+
+  test('rejects a foreign session-less native client during unauthenticated recovery', async () => {
+    const activeSession = {
+      id: 'session_1',
+      status: 'active',
+      user: { id: 'user_1' },
+    };
+    const foreignClient = {
+      id: 'client_foreign',
+      signedInSessions: [],
+      lastActiveSessionId: null,
+    };
+    const updateClient = mocks.clerkInstance.updateClient;
+    const originalHandleUnauthenticated = mocks.clerkInstance.handleUnauthenticated;
+
+    mocks.tokenCache.getToken.mockResolvedValue('js-device-token');
+    mocks.getClientToken.mockResolvedValue('js-device-token');
+    mocks.clerkInstance.client = {
+      id: 'client_js',
+      signedInSessions: [activeSession],
+      lastActiveSessionId: activeSession.id,
+      fetch: vi.fn().mockResolvedValue(foreignClient),
+    };
+    mocks.clerkInstance.session = activeSession;
+
+    render(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(mocks.configure).toHaveBeenCalledWith('pk_test_123', 'js-device-token');
+    });
+    await waitFor(() => {
+      expect(mocks.clerkInstance.handleUnauthenticated).not.toBe(originalHandleUnauthenticated);
+    });
+
+    mocks.getClientToken.mockResolvedValue('ghost-device-token');
+    mocks.tokenCache.saveToken.mockClear();
+
+    await act(async () => {
+      await mocks.clerkInstance.handleUnauthenticated();
+    });
+
+    expect(updateClient).not.toHaveBeenCalledWith(foreignClient);
+    expect(mocks.clerkInstance.session).toBe(activeSession);
+    expect(originalHandleUnauthenticated).not.toHaveBeenCalled();
+    expect(mocks.tokenCache.saveToken).toHaveBeenCalledWith(CLERK_CLIENT_JWT_KEY, 'ghost-device-token');
+    expect(mocks.tokenCache.saveToken).toHaveBeenCalledWith(CLERK_CLIENT_JWT_KEY, 'js-device-token');
+  });
+
+  test('skips native adoption when the cached device token read times out while signed in', async () => {
+    const activeSession = {
+      id: 'session_1',
+      status: 'active',
+      user: { id: 'user_1' },
+    };
+    const fetchClient = vi.fn().mockResolvedValue({
+      id: 'client_foreign',
+      signedInSessions: [],
+      lastActiveSessionId: null,
+    });
+
+    mocks.tokenCache.getToken.mockResolvedValue('js-device-token');
+    mocks.getClientToken.mockResolvedValue('js-device-token');
+    mocks.clerkInstance.client = {
+      id: 'client_js',
+      signedInSessions: [activeSession],
+      lastActiveSessionId: activeSession.id,
+      fetch: fetchClient,
+    };
+    mocks.clerkInstance.session = activeSession;
+
+    const { rerender } = render(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(mocks.configure).toHaveBeenCalledWith('pk_test_123', 'js-device-token');
+    });
+
+    mocks.tokenCache.getToken.mockImplementation(() => new Promise(() => {}));
+    mocks.tokenCache.saveToken.mockClear();
+    mocks.tokenCache.clearToken.mockClear();
+
+    mocks.nativeClientEvent = {
+      issuedAt: 1,
+      changed: {
+        client: true,
+        deviceToken: true,
+      },
+      deviceToken: 'native-device-token',
+    };
+    rerender(
+      <ClerkProvider
+        publishableKey='pk_test_123'
+        tokenCache={mocks.tokenCache}
+      />,
+    );
+
+    await act(async () => {
+      await new Promise(resolve => setTimeout(resolve, 1_200));
+    });
+
+    expect(mocks.tokenCache.saveToken).not.toHaveBeenCalledWith(CLERK_CLIENT_JWT_KEY, 'native-device-token');
+    expect(mocks.tokenCache.clearToken).not.toHaveBeenCalled();
+    expect(fetchClient).not.toHaveBeenCalled();
+    expect(mocks.clerkInstance.session).toBe(activeSession);
+  });
 });
diff --git a/packages/expo/src/provider/nativeClientSync.tsx b/packages/expo/src/provider/nativeClientSync.tsx
index 1f50aa0699e..6893e357ec8 100644
--- a/packages/expo/src/provider/nativeClientSync.tsx
+++ b/packages/expo/src/provider/nativeClientSync.tsx
@@ -40,6 +40,7 @@ type NativeRefreshFromJsOptions = {
 
 export type NativeRefreshFromJsController = {
   cancel: () => void;
+  syncDeviceTokenToNative: (deviceToken: string | null) => void;
 };
 
 export type DeviceTokenCacheListener = (deviceToken: string | null) => void;
@@ -204,22 +205,38 @@ function getDefaultSignedInSession(client: ClientResource | null | undefined): S
   return client.signedInSessions[0] ?? null;
 }
 
-async function refreshJsClientFromServer(clerkInstance: SyncableClerkInstance): Promise<ClientResource | null> {
+function canRefreshJsClientFromServer(clerkInstance: SyncableClerkInstance): boolean {
+  const client = clerkInstance.client as RefreshableClientResource | undefined;
+
+  return typeof client?.fetch === 'function' && typeof clerkInstance.updateClient === 'function';
+}
+
+function fetchRefreshedJsClient(clerkInstance: SyncableClerkInstance): Promise<ClientResource | null> {
   const client = clerkInstance.client as RefreshableClientResource | undefined;
 
   if (typeof client?.fetch !== 'function' || typeof clerkInstance.updateClient !== 'function') {
-    return null;
+    return Promise.resolve(null);
   }
 
-  const refreshedClient = await client.fetch({ fetchMaxTries: 1 });
-  clerkInstance.updateClient(refreshedClient);
+  return client.fetch({ fetchMaxTries: 1 });
+}
+
+function isForeignSessionlessClient(
+  previousClient: ClientResource | null | undefined,
+  refreshedClient: ClientResource,
+): boolean {
+  if (!previousClient?.id || !refreshedClient.id || previousClient.id === refreshedClient.id) {
+    return false;
+  }
 
-  return refreshedClient;
+  return Boolean(getDefaultSignedInSession(previousClient)) && refreshedClient.signedInSessions.length === 0;
 }
 
 async function refreshJsClientFromNativeState({
   clerkInstance,
   nativeDeviceToken,
+  previousDeviceToken,
+  rejectForeignSessionlessClient = false,
   reloadInitialResources,
   shouldSyncDeviceToken = true,
   suppressTokenCacheNotificationsRef,
@@ -227,21 +244,46 @@ async function refreshJsClientFromNativeState({
 }: {
   clerkInstance: SyncableClerkInstance;
   nativeDeviceToken: string | null;
+  previousDeviceToken?: string | null;
+  rejectForeignSessionlessClient?: boolean;
   reloadInitialResources: boolean;
   shouldSyncDeviceToken?: boolean;
   suppressTokenCacheNotificationsRef?: MutableRefObject<number>;
   tokenCache: TokenCache | undefined;
 }): Promise<boolean> {
-  if (shouldSyncDeviceToken) {
-    await syncNativeDeviceTokenToCache({
-      deviceToken: nativeDeviceToken,
-      suppressTokenCacheNotificationsRef,
-      tokenCache,
-    });
+  const previousClient = clerkInstance.client;
+
+  const restorePreviousDeviceToken = async () => {
+    if (!rejectForeignSessionlessClient || !shouldSyncDeviceToken || previousDeviceToken === undefined) {
+      return;
+    }
+
+    await syncDeviceTokenToCache(tokenCache, previousDeviceToken);
+  };
+
+  let refreshedClient: ClientResource | null;
+  try {
+    if (shouldSyncDeviceToken) {
+      await syncNativeDeviceTokenToCache({
+        deviceToken: nativeDeviceToken,
+        suppressTokenCacheNotificationsRef,
+        tokenCache,
+      });
+    }
+
+    refreshedClient = await fetchRefreshedJsClient(clerkInstance);
+  } catch (error) {
+    await restorePreviousDeviceToken();
+    throw error;
   }
 
-  const refreshedClient = await refreshJsClientFromServer(clerkInstance);
   if (refreshedClient) {
+    if (rejectForeignSessionlessClient && isForeignSessionlessClient(previousClient, refreshedClient)) {
+      await restorePreviousDeviceToken();
+      return true;
+    }
+
+    clerkInstance.updateClient?.(refreshedClient);
     await reconcileJsActiveSessionFromClient({
       clerkInstance,
     });
@@ -380,21 +422,26 @@ function mergePendingNativeRefreshOptions(
   return merged;
 }
 
-async function getCachedDeviceToken(tokenCache: TokenCache | undefined): Promise<string | null> {
+const tokenCacheReadTimedOut = Symbol('tokenCacheReadTimedOut');
+
+// `undefined` = read timed out, `null` = confirmed missing token.
+async function getCachedDeviceToken(tokenCache: TokenCache | undefined): Promise<string | null | undefined> {
   if (!tokenCache) {
     return null;
   }
 
   let timeoutId: ReturnType<typeof setTimeout> | undefined;
   try {
-    return (
-      (await Promise.race([
-        tokenCache.getToken(CLERK_CLIENT_JWT_KEY),
-        new Promise<null>(resolve => {
-          timeoutId = setTimeout(() => resolve(null), tokenCacheReadTimeoutMs);
-        }),
-      ])) ?? null
-    );
+    const result = await Promise.race([
+      tokenCache.getToken(CLERK_CLIENT_JWT_KEY),
+      new Promise<typeof tokenCacheReadTimedOut>(resolve => {
+        timeoutId = setTimeout(() => resolve(tokenCacheReadTimedOut), tokenCacheReadTimeoutMs);
+      }),
+    ]);
+    if (result === tokenCacheReadTimedOut) {
+      return undefined;
+    }
+    return result ?? null;
   } finally {
     if (timeoutId) {
       clearTimeout(timeoutId);
@@ -434,12 +481,29 @@ async function syncNativeClientToJs({
     return;
   }
 
+  const previousDeviceToken = didChangeDeviceToken ? await getCachedDeviceToken(tokenCache) : undefined;
+  const hasSignedInJsClient = Boolean(getDefaultSignedInSession(clerkInstance.client));
+
+  if (didChangeDeviceToken && hasSignedInJsClient) {
+    // Timed-out cache read leaves no rollback snapshot, so keep JS authoritative.
+    if (previousDeviceToken === undefined) {
+      return;
+    }
+
+    if (previousDeviceToken && !canRefreshJsClientFromServer(clerkInstance)) {
+      nativeRefreshFromJsControllerRef?.current?.syncDeviceTokenToNative(previousDeviceToken);
+      return;
+    }
+  }
+
   await runWithSuppressedJsClientChanges(suppressJsClientChangedRef, async () => {
     nativeRefreshFromJsControllerRef?.current?.cancel();
 
     await refreshJsClientFromNativeState({
       clerkInstance,
       nativeDeviceToken,
+      previousDeviceToken,
+      rejectForeignSessionlessClient: true,
       reloadInitialResources: true,
       shouldSyncDeviceToken: didChangeDeviceToken,
       suppressTokenCacheNotificationsRef,
@@ -486,18 +550,6 @@ export function NativeClientSync({
     isRefreshingNativeFromJsRef.current = false;
   }, []);
 
-  useEffect(() => {
-    nativeRefreshFromJsControllerRef.current = {
-      cancel: cancelNativeRefreshFromJs,
-    };
-
-    return () => {
-      if (nativeRefreshFromJsControllerRef.current?.cancel === cancelNativeRefreshFromJs) {
-        nativeRefreshFromJsControllerRef.current = null;
-      }
-    };
-  }, [cancelNativeRefreshFromJs, nativeRefreshFromJsControllerRef]);
-
   useEffect(() => {
     if (
       !clerkInstance ||
@@ -627,6 +679,25 @@ export function NativeClientSync({
     });
   }, []);
 
+  useEffect(() => {
+    nativeRefreshFromJsControllerRef.current = {
+      cancel: cancelNativeRefreshFromJs,
+      syncDeviceTokenToNative: deviceToken => {
+        queueNativeRefreshFromJs({
+          deviceToken,
+          didChangeClient: false,
+          didChangeDeviceToken: true,
+        });
+      },
+    };
+
+    return () => {
+      if (nativeRefreshFromJsControllerRef.current?.cancel === cancelNativeRefreshFromJs) {
+        nativeRefreshFromJsControllerRef.current = null;
+      }
+    };
+  }, [cancelNativeRefreshFromJs, nativeRefreshFromJsControllerRef, queueNativeRefreshFromJs]);
+
   useEffect(() => {
     if (!enabled) {
       pendingNativeRefreshBeforeReadyRef.current = null;
@@ -686,12 +757,15 @@ export function NativeClientSync({
         return await runWithSuppressedJsClientChanges(suppressJsClientChangedRef, async () => {
           try {
             const nativeDeviceToken = await readNativeDeviceToken({ waitForToken: false });
+            const previousDeviceToken = await getCachedDeviceToken(tokenCache);
             // Native may have already moved the server-side client to a new
             // active session. Refresh JS before allowing Clerk JS' stale-session
             // 401 path to collapse the whole client to signed out.
             const didRecover = await refreshJsClientFromNativeState({
               clerkInstance,
               nativeDeviceToken,
+              previousDeviceToken,
+              rejectForeignSessionlessClient: true,
               reloadInitialResources: false,
               suppressTokenCacheNotificationsRef,
               tokenCache,
@@ -857,7 +931,7 @@ export function useNativeClientBootstrap({
 
             let initialJsDeviceToken: string | null = null;
             try {
-              initialJsDeviceToken = await getCachedDeviceToken(tokenCache);
+              initialJsDeviceToken = (await getCachedDeviceToken(tokenCache)) ?? null;
             } catch (e) {
               if (__DEV__) {
                 console.warn('[ClerkProvider] Token cache read failed:', e);
@@ -876,7 +950,7 @@ export function useNativeClientBootstrap({
             }
 
             if (clerkInstance) {
-              const currentJsDeviceToken = await getCachedDeviceToken(tokenCache);
+              const currentJsDeviceToken = (await getCachedDeviceToken(tokenCache)) ?? null;
               const nativeDeviceToken = await readNativeDeviceToken({ waitForToken: false });
 
               if (!isCurrentConfiguration() || currentJsDeviceToken === nativeDeviceToken) {