diff --git a/packages/mcp/CHANGELOG.md b/packages/mcp/CHANGELOG.md
index 63d1df4a..26ab05ed 100644
--- a/packages/mcp/CHANGELOG.md
+++ b/packages/mcp/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 2.3.3-keycardai-mcp (2026-10-15)
+
+
+- fix(keycardai-mcp): refresh expired tokens instead of forcing a new sign-in (ECO-453)
+- The MCP client now refreshes a stored token before it expires and tries one refresh on a 401 before starting a new sign-in. A refused refresh (invalid_grant, or insufficient_authorization when the user no longer resolves) clears the tokens and falls back to sign-in; other refresh errors surface without prompting. Requires keycardai-oauth 0.33.0 or later.
+
 ## 2.3.2-keycardai-mcp (2026-09-16)
 
 ## 2.3.1-keycardai-mcp (2026-09-15)
diff --git a/packages/mcp/pyproject.toml b/packages/mcp/pyproject.toml
index dc1eff02..037edc19 100644
--- a/packages/mcp/pyproject.toml
+++ b/packages/mcp/pyproject.toml
@@ -142,7 +142,7 @@ filterwarnings = [
 
 [tool.commitizen]
 name = "cz_customize"
-version = "2.3.2"
+version = "2.3.3"
 tag_format = "${version}-keycardai-mcp"
 # Ignores sibling packages' tags only; it must not match this package's own tag, because commitizen applies ignored formats before tag_format.
 ignored_tag_formats = ["${version}-keycardai-(?!mcp$).*"]