diff --git a/core/src/main/java/org/apache/iceberg/rest/auth/OAuth2Util.java b/core/src/main/java/org/apache/iceberg/rest/auth/OAuth2Util.java
index b8db459edebd..c0242c11cf1d 100644
--- a/core/src/main/java/org/apache/iceberg/rest/auth/OAuth2Util.java
+++ b/core/src/main/java/org/apache/iceberg/rest/auth/OAuth2Util.java
@@ -734,7 +734,18 @@ public static AuthSession fromTokenExchange(
               parent.scope(),
               parent.oauth2ServerUri(),
               parent.optionalOAuthParams());
-      return fromTokenResponse(client, executor, response, startTimeMillis, parent);
+      AuthSession session = fromTokenResponse(client, executor, response, startTimeMillis, parent);
+      // A session created by token exchange should be refreshed via token exchange,
+      // not by falling back to the parent's client credential. Clear the inherited
+      // credential and enable exchange on the child session so that refresh always
+      // uses the token exchange flow, independent of the catalog-level exchangeEnabled flag.
+      session.config =
+          AuthConfig.builder()
+              .from(session.config)
+              .credential(null)
+              .exchangeEnabled(true)
+              .build();
+      return session;
     }
   }
 }