diff --git a/controllers/classifier_report_collection.go b/controllers/classifier_report_collection.go
index 097e809..c3b3ade 100644
--- a/controllers/classifier_report_collection.go
+++ b/controllers/classifier_report_collection.go
@@ -442,6 +442,13 @@ func collectClassifierReportsFromCluster(ctx context.Context, c client.Client,
 	classifierReportList := libsveltosv1beta1.ClassifierReportList{}
 	err = clusterClient.List(ctx, &classifierReportList, listOptions...)
 	if err != nil {
+		// getClassifierClient succeeding only means the cached rest.Config was non-nil - it
+		// does not verify the credentials still work, since client.New performs no network
+		// call. A token that expired since the config was cached surfaces here, on first
+		// actual use, not there. Evict so the next collection cycle rebuilds the client from a
+		// freshly-read kubeconfig Secret instead of retrying the same stale credentials forever.
+		clustercache.GetManager().InvalidateOnAuthError(cluster.Namespace, cluster.Name,
+			clusterproxy.GetClusterType(cluster), err)
 		return err
 	}