diff --git a/agent/middleware/workflow_push_guard.py b/agent/middleware/workflow_push_guard.py
index bc794610..c0124b83 100644
--- a/agent/middleware/workflow_push_guard.py
+++ b/agent/middleware/workflow_push_guard.py
@@ -896,7 +896,19 @@ async def _run_with_workflow_token(
     finally:
         restored = await refresh_proxy_token(thread_id, permissions=RUNTIME_PROXY_TOKEN_PERMISSIONS)
         if not restored:
-            await refresh_proxy_token(thread_id, permissions=BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS)
+            logger.error(
+                "SECURITY: failed to downscope proxy token for thread %s after an approved "
+                "workflow push; retrying without actions:read.",
+                thread_id,
+            )
+            if not await refresh_proxy_token(
+                thread_id, permissions=BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS
+            ):
+                logger.error(
+                    "SECURITY: proxy token downscope fully failed for thread %s; the sandbox "
+                    "may retain workflows:write for the remainder of this run.",
+                    thread_id,
+                )
 
 
 class WorkflowPushGuardMiddleware(AgentMiddleware):