diff --git a/tools/mcp_oauth.py b/tools/mcp_oauth.py
index c824478e64..6e17a8e821 100644
--- a/tools/mcp_oauth.py
+++ b/tools/mcp_oauth.py
@@ -566,7 +566,9 @@ class HermesTokenStorage:
 
     def remove(self) -> None:
         """Delete all stored OAuth state for this server."""
-        for p in (*self._state_paths(), self._cimd_rejected_path(), _refresh_lock_path(self._tokens_path())):
+        # The ``.refresh.lock`` sidecar is deliberately kept: flock is inode-bound, so unlinking it
+        # while a peer holds the fence would let the next acquirer lock a fresh inode (two holders).
+        for p in (*self._state_paths(), self._cimd_rejected_path()):
             p.unlink(missing_ok=True)
 
     def snapshot(self) -> dict[str, bytes]: