diff --git a/internal/cli/run.go b/internal/cli/run.go
index 8316761095..eff933c20d 100644
--- a/internal/cli/run.go
+++ b/internal/cli/run.go
@@ -921,7 +921,12 @@ func runAgent(ctx context.Context, agentName, fullsendDir, outputBase, targetRep
 		if err != nil {
 			printer.StepWarn("OIDC token refresh disabled: " + err.Error())
 		} else {
-			printer.StepDone("OIDC token refresh enabled (WIF mode)")
+			// GHA OIDC tokens expire after 5 min; sandbox setup can exceed that.
+			if err := refreshOIDCToken(oidcCtx, sandboxName, oidcURL, oidcAuth); err != nil {
+				printer.StepWarn("Initial OIDC refresh failed (will retry): " + err.Error())
+			} else {
+				printer.StepDone("OIDC token refreshed, background refresh enabled (WIF mode)")
+			}
 			oidcWg.Add(1)
 			go func() {
 				defer oidcWg.Done()
diff --git a/internal/scaffold/fullsend-repo/scripts/prepare-sandbox-credentials.sh b/internal/scaffold/fullsend-repo/scripts/prepare-sandbox-credentials.sh
index 34ba425ee5..a1c3a243f4 100755
--- a/internal/scaffold/fullsend-repo/scripts/prepare-sandbox-credentials.sh
+++ b/internal/scaffold/fullsend-repo/scripts/prepare-sandbox-credentials.sh
@@ -9,7 +9,7 @@ set -euo pipefail
 # endpoint, so this script pre-fetches the OIDC token and rewrites the config
 # to use a file-based credential source instead.
 #
-# Note: the OIDC token expires after ~10 min. The fullsend CLI refreshes it
+# Note: the OIDC token expires after ~5 min. The fullsend CLI refreshes it
 # automatically using FULLSEND_GCP_OIDC_URL and FULLSEND_GCP_OIDC_AUTH_FILE
 # exported below.
 #