diff --git a/open-sse/services/refreshSerializer.ts b/open-sse/services/refreshSerializer.ts
index f71d5c4190..55f37c62ce 100644
--- a/open-sse/services/refreshSerializer.ts
+++ b/open-sse/services/refreshSerializer.ts
@@ -112,8 +112,8 @@ export async function serializeRefresh<T>(provider: string, fn: () => Promise<T>
  * and codex-lb's replica race-detection.
  */
 export function wasRefreshTokenRotated(
-  attemptedRefreshToken: string | null | undefined,
-  latestRefreshToken: string | null | undefined
+  attemptedRefreshToken: unknown,
+  latestRefreshToken: unknown
 ): boolean {
   return (
     typeof attemptedRefreshToken === "string" &&
diff --git a/tests/unit/refresh-serializer.test.ts b/tests/unit/refresh-serializer.test.ts
index f764bd0d90..5b80ce4b3e 100644
--- a/tests/unit/refresh-serializer.test.ts
+++ b/tests/unit/refresh-serializer.test.ts
@@ -109,4 +109,6 @@ test("wasRefreshTokenRotated: true only when the DB token changed to a non-empty
   assert.equal(wasRefreshTokenRotated("rt-old", ""), false, "empty DB token = deactivate");
   assert.equal(wasRefreshTokenRotated(null, "rt-new"), false, "unknown attempted = deactivate");
   assert.equal(wasRefreshTokenRotated(undefined, undefined), false);
+  assert.equal(wasRefreshTokenRotated("rt-old", { token: "rt-new" }), false);
+  assert.equal(wasRefreshTokenRotated(42, "rt-new"), false);
 });