diff --git a/spinifex/services/spinifexui/frontend/src/lib/auth-error.test.ts b/spinifex/services/spinifexui/frontend/src/lib/auth-error.test.ts
index b761a1980..af82582fa 100644
--- a/spinifex/services/spinifexui/frontend/src/lib/auth-error.test.ts
+++ b/spinifex/services/spinifexui/frontend/src/lib/auth-error.test.ts
@@ -12,10 +12,8 @@ function sdkError(name: string): Error {
 describe("isStaleCredentialsError", () => {
   const authCodes = [
     "InvalidClientTokenId",
-    "SignatureDoesNotMatch",
     "AuthFailure",
     "MissingAuthenticationToken",
-    "IncompleteSignature",
     "UnrecognizedClientException",
     "ExpiredToken",
     "ExpiredTokenException",
@@ -37,6 +35,9 @@ describe("isStaleCredentialsError", () => {
     ["UnauthorizedOperation denial", sdkError("UnauthorizedOperation")],
     ["ValidationError", sdkError("ValidationError")],
     ["InvalidParameterValue", sdkError("InvalidParameterValue")],
+    // Clock skew and path rewrites also produce these; logging out would loop.
+    ["SignatureDoesNotMatch", sdkError("SignatureDoesNotMatch")],
+    ["IncompleteSignature", sdkError("IncompleteSignature")],
     ["NotFound", sdkError("InvalidInstanceID.NotFound")],
     ["plain Error", new Error("boom")],
     ["network failure", new TypeError("Failed to fetch")],
diff --git a/spinifex/services/spinifexui/frontend/src/lib/auth-error.ts b/spinifex/services/spinifexui/frontend/src/lib/auth-error.ts
index 9f4ed1631..99a19385c 100644
--- a/spinifex/services/spinifexui/frontend/src/lib/auth-error.ts
+++ b/spinifex/services/spinifexui/frontend/src/lib/auth-error.ts
@@ -1,12 +1,10 @@
 // AWS error codes that indicate the credentials themselves are stale or
-// invalid (authentication failures), as opposed to authorization denials
-// (AccessDenied / UnauthorizedOperation) where valid creds lack permission.
+// invalid, as opposed to authorization denials. Signature errors are left out:
+// clock skew and a rewritten request path also cause them.
 const AUTH_ERROR_CODES = new Set([
   "InvalidClientTokenId",
-  "SignatureDoesNotMatch",
   "AuthFailure",
   "MissingAuthenticationToken",
-  "IncompleteSignature",
   "UnrecognizedClientException",
   "ExpiredToken",
   "ExpiredTokenException",