@@ -586,35 +586,89 @@ describe('OAuth token route in PostgreSQL', () => {
           .where(eq(schema.oauthTokenFamily.id, secondRefresh?.familyId ?? 'missing'))
       ).toHaveLength(0)
 
-      const racingVerifier = `${testId}-racing-verifier-with-more-than-forty-three-characters`
-      const racingCode = await issueAuthorizationCode(racingVerifier)
-      const exchangeSameCode = () =>
+      const exchangeCode = (code: string, verifier: string) =>
         exchangeToken(
           createFormRequest(
             '/api/auth/oauth2/token',
             new URLSearchParams({
               grant_type: 'authorization_code',
               client_id: provider.SIM_CLI_CLIENT_ID,
-              code: racingCode,
-              code_verifier: racingVerifier,
+              code,
+              code_verifier: verifier,
               redirect_uri: redirectUri,
             })
           )
         )
-      const racingResponses = await Promise.all([exchangeSameCode(), exchangeSameCode()])
-      expect(racingResponses.map((response) => response.status).sort()).toEqual([200, 400])
-      const rejectedExchange = racingResponses.find((response) => response.status === 400)
-      await expect(rejectedExchange?.json()).resolves.toMatchObject({ error: 'invalid_grant' })
-      expect(
-        await db
+      const familyIdsForUser = () =>
+        db
           .select({ id: schema.oauthTokenFamily.id })
           .from(schema.oauthTokenFamily)
           .where(eq(schema.oauthTokenFamily.userId, userId))
-      ).toHaveLength(1)
 
-      const activeTokens = (await racingResponses
-        .find((response) => response.status === 200)
-        ?.json()) as TokenResponseBody
+      const racingVerifier = `${testId}-racing-verifier-with-more-than-forty-three-characters`
+      const racingCode = await issueAuthorizationCode(racingVerifier)
+      const racingResponses = await Promise.all([
+        exchangeCode(racingCode, racingVerifier),
+        exchangeCode(racingCode, racingVerifier),
+      ])
+      // The replay revokes whatever the first exchange has issued so far, so which of the two
+      // succeeds depends on interleaving; neither may fail as a server error or strand a family.
+      const racingStatuses = racingResponses.map((response) => response.status)
+      expect(racingStatuses).toContain(400)
+      expect(racingStatuses.every((status) => status === 200 || status === 400)).toBe(true)
+      for (const response of racingResponses.filter(({ status }) => status === 400)) {
+        await expect(response.json()).resolves.toMatchObject({ error: 'invalid_grant' })
+      }
+      const refreshFamilyIds = new Set(
+        (
+          await db
+            .select({ familyId: schema.oauthRefreshToken.familyId })
+            .from(schema.oauthRefreshToken)
+            .where(eq(schema.oauthRefreshToken.userId, userId))
+        ).map(({ familyId }) => familyId)
+      )
+      expect((await familyIdsForUser()).every(({ id }) => refreshFamilyIds.has(id))).toBe(true)
+      for (const response of racingResponses.filter(({ status }) => status === 200)) {
+        const { refresh_token } = (await response.json()) as TokenResponseBody
+        await revokeToken(
+          createFormRequest(
+            '/api/auth/oauth2/revoke',
+            new URLSearchParams({ client_id: provider.SIM_CLI_CLIENT_ID, token: refresh_token })
+          )
+        )
+      }
+      expect(await familyIdsForUser()).toHaveLength(0)
+
+      const replayVerifier = `${testId}-replay-verifier-with-more-than-forty-three-characters`
+      const replayCode = await issueAuthorizationCode(replayVerifier)
+      const firstExchange = await exchangeCode(replayCode, replayVerifier)
+      expect(firstExchange.status).toBe(200)
+      const firstGrant = (await firstExchange.json()) as TokenResponseBody
+      expect(await familyIdsForUser()).toHaveLength(1)
+      const replayedExchange = await exchangeCode(replayCode, replayVerifier)
+      expect(replayedExchange.status).toBe(400)
+      await expect(replayedExchange.json()).resolves.toMatchObject({ error: 'invalid_grant' })
+      expect(await familyIdsForUser()).toHaveLength(0)
+      const refreshAfterReplay = await exchangeToken(
+        createFormRequest(
+          '/api/auth/oauth2/token',
+          new URLSearchParams({
+            grant_type: 'refresh_token',
+            client_id: provider.SIM_CLI_CLIENT_ID,
+            refresh_token: firstGrant.refresh_token,
+          })
+        )
+      )
+      expect(refreshAfterReplay.status).toBe(400)
+
+      const activeVerifier = `${testId}-active-verifier-with-more-than-forty-three-characters`
+      const activeExchange = await exchangeCode(
+        await issueAuthorizationCode(activeVerifier),
+        activeVerifier
+      )
+      expect(activeExchange.status).toBe(200)
+      const activeTokens = (await activeExchange.json()) as TokenResponseBody
+      expect(await familyIdsForUser()).toHaveLength(1)
       const withheldVerifier = `${testId}-withheld-verifier-with-more-than-forty-three-characters`
       const withheldCode = await issueAuthorizationCode(withheldVerifier)
       const consentUrl = await createAuthorizeUrl(withheldVerifier)
 
@@ -112,6 +112,26 @@ describe('guardOAuthProviderWrites', () => {
     expect(mocks.insert).not.toHaveBeenCalled()
   })
 
+  it('refuses an access token whose refresh token a concurrent replay revoked', async () => {
+    const base = adapter()
+    vi.mocked(base.create).mockRejectedValueOnce(
+      Object.assign(new Error('Failed query'), {
+        cause: Object.assign(new Error('violates foreign key constraint'), {
+          code: '23503',
+          constraint_name: 'oauth_access_token_refresh_id_oauth_refresh_token_id_fk',
+        }),
+      })
+    )
+    const guarded = guardOAuthProviderWrites(base)
+
+    await expect(
+      guarded.create({
+        model: 'oauthAccessToken',
+        data: { userId: 'user-1', scopes: ['api:read'], refreshId: 'revoked' },
+      })
+    ).rejects.toMatchObject({ body: { error: 'invalid_grant' } })
+  })
+
   it.each(['oauthAccessToken', 'oauthRefreshToken'])(
     'persists the verified audience on %s and ignores injected resource fields',
     async (model) => {
 
@@ -1,10 +1,11 @@
 import { AsyncLocalStorage } from 'node:async_hooks'
 import type { db } from '@sim/db'
-import { oauthConsent, oauthTokenFamily } from '@sim/db/schema'
+import { oauthConsent, oauthRefreshToken, oauthTokenFamily } from '@sim/db/schema'
+import { getPostgresConstraintName, getPostgresErrorCode } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
 import type { drizzleAdapter } from 'better-auth/adapters/drizzle'
 import { APIError } from 'better-auth/api'
-import { inArray } from 'drizzle-orm'
+import { eq, inArray } from 'drizzle-orm'
 import { getAuthPool } from '@/lib/auth/database-context'
 import { getOAuthIssuedResource } from '@/lib/auth/oauth-resource'
 import { capabilityRefusal } from '@/lib/permission-groups/capabilities'
@@ -61,6 +62,30 @@ export async function withOAuthProviderIssuanceCompensation<T extends Response>(
   }
 }
 
+const ACCESS_TOKEN_REFRESH_FK = 'oauth_access_token_refresh_id_oauth_refresh_token_id_fk'
+
+/**
+ * Better Auth revokes a replayed code's grant by deleting its tokens by `authorizationCodeId`,
+ * which would leave Sim's token family behind. Deleting the families instead cascades to their
+ * refresh tokens and the access tokens bound to them.
+ */
+async function deleteFamiliesIssuedForAuthorizationCode(
+  database: AuthDatabase,
+  authorizationCodeId: string
+): Promise<void> {
+  await database
+    .delete(oauthTokenFamily)
+    .where(
+      inArray(
+        oauthTokenFamily.id,
+        database
+          .select({ id: oauthRefreshToken.familyId })
+          .from(oauthRefreshToken)
+          .where(eq(oauthRefreshToken.authorizationCodeId, authorizationCodeId))
+      )
+    )
+}
+
 function requireConsentInsert(data: Record<string, unknown>): OAuthConsentInsert {
   if (
     typeof data.clientId !== 'string' ||
@@ -106,6 +131,18 @@ export function guardOAuthProviderWrites(
 ): BetterAuthAdapter {
   return {
     ...adapter,
+    deleteMany: async (input) => {
+      const [condition, ...rest] = input.where
+      if (
+        input.model === 'oauthRefreshToken' &&
+        rest.length === 0 &&
+        condition?.field === 'authorizationCodeId' &&
+        typeof condition.value === 'string'
+      ) {
+        await deleteFamiliesIssuedForAuthorizationCode(database, condition.value)
+      }
+      return adapter.deleteMany(input)
+    },
     create: async (input) => {
       /**
        * permission-group-enforced: oauth_apps.use — recheck the canonical token
@@ -133,7 +170,22 @@ export function guardOAuthProviderWrites(
       }
 
       if (input.model !== 'oauthConsent') {
-        const created = await adapter.create(input)
+        const created = await adapter.create(input).catch((error: unknown) => {
+          // Issuance is not transactional: a concurrent replay can revoke the grant between the
+          // refresh and access inserts, so the access insert's foreign key fails. Refuse it the
+          // way the replay is refused rather than as a server error.
+          if (
+            input.model === 'oauthAccessToken' &&
+            getPostgresErrorCode(error) === '23503' &&
+            getPostgresConstraintName(error) === ACCESS_TOKEN_REFRESH_FK
+          ) {
+            throw new APIError('BAD_REQUEST', {
+              error: 'invalid_grant',
+              error_description: 'The authorization grant was revoked.',
+            })
+          }
+          throw error
+        })
         if (input.model === 'oauthRefreshToken') {
           const id = (created as { id?: unknown }).id
           if (typeof id !== 'string' || !id) {