diff --git a/oidc-proxy/src/index.js b/oidc-proxy/src/index.js
index 398006e30d..a942a95e53 100644
--- a/oidc-proxy/src/index.js
+++ b/oidc-proxy/src/index.js
@@ -195,7 +195,9 @@ async function verifyOidcToken(token, env) {
       if (age > parseInt(env.MAX_TOKEN_AGE_SECONDS, 10)) {
         return { valid: false, reason: "Token too old" };
       }
-    } else if (!payload.exp || payload.exp < Date.now() / 1000) {
+    }
+
+    if (!payload.exp || payload.exp < Date.now() / 1000) {
       return { valid: false, reason: "Token expired" };
     }
 
diff --git a/oidc-proxy/test/index.test.js b/oidc-proxy/test/index.test.js
index 37abb28741..1a1d0b8bbf 100644
--- a/oidc-proxy/test/index.test.js
+++ b/oidc-proxy/test/index.test.js
@@ -229,7 +229,7 @@ describe("proxies valid requests", () => {
     expect((await response.json()).id).toBe("msg_123");
   });
 
-  it("accepts recently-expired token within MAX_TOKEN_AGE_SECONDS", async () => {
+  it("rejects expired token even when within MAX_TOKEN_AGE_SECONDS", async () => {
     const now = Math.floor(Date.now() / 1000);
     const token = await createSignedJwt(
       validPayload({ iat: now - 600, exp: now - 300 }),
@@ -245,7 +245,8 @@ describe("proxies valid requests", () => {
     const response = await worker.fetch(request, testEnv(), ctx);
     await waitOnExecutionContext(ctx);
 
-    expect(response.status).toBe(200);
+    expect(response.status).toBe(401);
+    expect((await response.json()).error).toBe("Token expired");
   });
 });