diff --git a/dist/build.js b/dist/build.js
index 617e320..283117d 100644
--- a/dist/build.js
+++ b/dist/build.js
@@ -26570,6 +26570,21 @@ function createAutoRefreshFetch(initialAuth, refreshAuth) {
     return fetch(input, { ...init, headers });
   };
 }
+var addFetch401Retries = (fetch2, { numRetries }) => {
+  return async (input, init) => {
+    let attempts = 0;
+    let response;
+    do {
+      response = await fetch2(input, init);
+      if (response.status !== 401) {
+        break;
+      }
+      attempts++;
+      logger.warn("Received 401 response, retrying...");
+    } while (attempts <= numRetries);
+    return response;
+  };
+};
 function getStainlessClient(action, opts) {
   const headers = {
     "User-Agent": `Stainless/Action ${package_default.version}`
@@ -26604,7 +26619,10 @@ function wrapAction(actionType, fn) {
         apiKey: auth.key,
         logLevel: "warn",
         logger,
-        fetch: createAutoRefreshFetch(auth, getStainlessAuth)
+        fetch: addFetch401Retries(
+          createAutoRefreshFetch(auth, getStainlessAuth),
+          { numRetries: 2 }
+        )
       });
       await fn(stainless);
       await maybeReportResult({
diff --git a/dist/merge.js b/dist/merge.js
index e6c13fe..08ebf9c 100644
--- a/dist/merge.js
+++ b/dist/merge.js
@@ -19949,6 +19949,21 @@ function createAutoRefreshFetch(initialAuth, refreshAuth) {
     return fetch(input, { ...init, headers });
   };
 }
+var addFetch401Retries = (fetch2, { numRetries }) => {
+  return async (input, init) => {
+    let attempts = 0;
+    let response;
+    do {
+      response = await fetch2(input, init);
+      if (response.status !== 401) {
+        break;
+      }
+      attempts++;
+      logger.warn("Received 401 response, retrying...");
+    } while (attempts <= numRetries);
+    return response;
+  };
+};
 function getStainlessClient(action, opts) {
   const headers = {
     "User-Agent": `Stainless/Action ${package_default.version}`
@@ -19983,7 +19998,10 @@ function wrapAction(actionType, fn) {
         apiKey: auth.key,
         logLevel: "warn",
         logger,
-        fetch: createAutoRefreshFetch(auth, getStainlessAuth)
+        fetch: addFetch401Retries(
+          createAutoRefreshFetch(auth, getStainlessAuth),
+          { numRetries: 2 }
+        )
       });
       await fn(stainless);
       await maybeReportResult({
diff --git a/dist/preview.js b/dist/preview.js
index 01e39ba..f84d3a3 100644
--- a/dist/preview.js
+++ b/dist/preview.js
@@ -20016,6 +20016,21 @@ function createAutoRefreshFetch(initialAuth, refreshAuth) {
     return fetch(input, { ...init, headers });
   };
 }
+var addFetch401Retries = (fetch2, { numRetries }) => {
+  return async (input, init) => {
+    let attempts = 0;
+    let response;
+    do {
+      response = await fetch2(input, init);
+      if (response.status !== 401) {
+        break;
+      }
+      attempts++;
+      logger.warn("Received 401 response, retrying...");
+    } while (attempts <= numRetries);
+    return response;
+  };
+};
 function getStainlessClient(action, opts) {
   const headers = {
     "User-Agent": `Stainless/Action ${package_default.version}`
@@ -20050,7 +20065,10 @@ function wrapAction(actionType, fn) {
         apiKey: auth.key,
         logLevel: "warn",
         logger,
-        fetch: createAutoRefreshFetch(auth, getStainlessAuth)
+        fetch: addFetch401Retries(
+          createAutoRefreshFetch(auth, getStainlessAuth),
+          { numRetries: 2 }
+        )
       });
       await fn(stainless);
       await maybeReportResult({
diff --git a/src/stainless.ts b/src/stainless.ts
index 630682c..a0710b7 100644
--- a/src/stainless.ts
+++ b/src/stainless.ts
@@ -30,6 +30,29 @@ export function createAutoRefreshFetch(
   };
 }
 
+/**
+ * adds retries to a fetch function for 401 responses, as it seems that OIDC decode on the server can
+ * occasionally fail transiently
+ */
+export const addFetch401Retries = (
+  fetch: typeof globalThis.fetch,
+  { numRetries }: { numRetries: number },
+): typeof globalThis.fetch => {
+  return async (input, init) => {
+    let attempts = 0;
+    let response;
+    do {
+      response = await fetch(input, init);
+      if (response.status !== 401) {
+        break;
+      }
+      attempts++;
+      logger.warn("Received 401 response, retrying...");
+    } while (attempts <= numRetries);
+    return response;
+  };
+};
+
 export function getStainlessClient(
   action: string | undefined,
   opts: ClientOptions,
diff --git a/src/wrapAction.ts b/src/wrapAction.ts
index 88e54cb..0c71fdb 100644
--- a/src/wrapAction.ts
+++ b/src/wrapAction.ts
@@ -1,7 +1,11 @@
 import Stainless from "@stainless-api/sdk";
 import { getInput } from "./compat/input";
 import { getStainlessAuth } from "./compat";
-import { createAutoRefreshFetch, getStainlessClient } from "./stainless";
+import {
+  addFetch401Retries,
+  createAutoRefreshFetch,
+  getStainlessClient,
+} from "./stainless";
 import { logger } from "./logger";
 
 const accumulatedBuildIds = new Set<string>();
@@ -33,7 +37,10 @@ export function wrapAction(
         apiKey: auth.key,
         logLevel: "warn",
         logger,
-        fetch: createAutoRefreshFetch(auth, getStainlessAuth),
+        fetch: addFetch401Retries(
+          createAutoRefreshFetch(auth, getStainlessAuth),
+          { numRetries: 2 },
+        ),
       });
       await fn(stainless);
       await maybeReportResult({