diff --git a/web/src/app/services/auth/auth.service.spec.ts b/web/src/app/services/auth/auth.service.spec.ts
index d2ce18d6b..9a5f06932 100644
--- a/web/src/app/services/auth/auth.service.spec.ts
+++ b/web/src/app/services/auth/auth.service.spec.ts
@@ -33,7 +33,13 @@ describe('AuthService', () => {
       providers: [
         {provide: AngularFirestore, useValue: {}},
         {provide: AngularFireFunctions, useValue: {}},
-        {provide: AngularFireAuth, useValue: {authState: NEVER}},
+        {
+          provide: AngularFireAuth,
+          useValue: {
+            authState: NEVER,
+            onIdTokenChanged: (callback: Function) => callback(null),
+          },
+        },
         {provide: DataStoreService, useValue: {user$: () => of()}},
         {provide: Router, useValue: {}},
         {provide: HttpClientService, useValue: {}},
diff --git a/web/src/app/services/auth/auth.service.ts b/web/src/app/services/auth/auth.service.ts
index 701b50c1c..d495bd652 100644
--- a/web/src/app/services/auth/auth.service.ts
+++ b/web/src/app/services/auth/auth.service.ts
@@ -19,8 +19,8 @@ import {AngularFireAuth} from '@angular/fire/compat/auth';
 import {AngularFireFunctions} from '@angular/fire/compat/functions';
 import {GoogleAuthProvider} from 'firebase/auth';
 import firebase from 'firebase/compat/app';
-import {Observable, firstValueFrom, from} from 'rxjs';
-import {map, shareReplay, switchMap} from 'rxjs/operators';
+import {Observable, Subject, firstValueFrom, from} from 'rxjs';
+import {map, mergeWith, shareReplay, switchMap} from 'rxjs/operators';
 
 import {AclEntry} from 'app/models/acl-entry.model';
 import {DataCollectionStrategy, Job} from 'app/models/job.model';
@@ -52,6 +52,7 @@ export const ROLE_OPTIONS = [
 })
 export class AuthService {
   private user$: Observable<User>;
+  private tokenChanged$ = new Subject<firebase.User | null>();
   private currentUser!: User;
   private hasAcceptedTos = false;
 
@@ -62,7 +63,9 @@ export class AuthService {
     private functions: AngularFireFunctions,
     private httpClientService: HttpClientService
   ) {
+    this.afAuth.onIdTokenChanged(user => this.tokenChanged$.next(user));
     this.user$ = this.afAuth.authState.pipe(
+      mergeWith(this.tokenChanged$),
       switchMap(user => from(this.onAuthStateChange(user))),
       map(user => user || ANONYMOUS_USER),
       // Cache last authenticated user so that late subscribers receive it as well.