diff --git a/src/at/oauth.gleam b/src/at/oauth.gleam
index 130dbb7..43e1762 100644
--- a/src/at/oauth.gleam
+++ b/src/at/oauth.gleam
@@ -920,6 +920,29 @@ pub fn session_decoder() -> Decoder(Session(Unverified)) {
   ))
 }
 
+pub fn refreshed_session_decoder(
+  previous: Session(Verified),
+) -> Decoder(Session(Verified)) {
+  use _ <- decode.field("sub", {
+    decode.then(did.decoder(), fn(subject) {
+      case subject == previous.subject {
+        True -> decode.success(subject)
+        False -> decode.failure(subject, did.to_string(previous.subject))
+      }
+    })
+  })
+
+  use next <- decode.map(session_decoder())
+
+  Session(
+    access_token: next.access_token,
+    refresh_token: next.refresh_token,
+    expires_in: next.expires_in,
+    scopes: next.scopes,
+    subject: next.subject,
+  )
+}
+
 // DPOP REQUESTS ---------------------------------------------------------------
 
 pub opaque type DpopRequest(body) {