diff --git a/.changes/legacy-global-slot-recovery.md b/.changes/legacy-global-slot-recovery.md
new file mode 100644
index 00000000..daaf9dab
--- /dev/null
+++ b/.changes/legacy-global-slot-recovery.md
@@ -0,0 +1,5 @@
+---
+category: Fixed
+---
+
+- **Legacy global slot recovery** — recovers a rejected identity refresh from the legacy global keychain slot when the organization mirror is absent, with strict corp/user matching so blank-user legacy tokens only recover for single-account organizations.