diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1968dd9b..71cd4e45 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,7 +14,8 @@ If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If
 ## Fixed
 - Directory: 
   - Invalidate caches when group memberships change on an external directory.
-  - Return OIDC errors instead of "failed to decode token".
+  - OIDC: errors instead of "failed to decode token".
+  - OIDC: Recovery admin access.
   - User impersonation.
 - Tasks:
   - Delete locked tasks.
diff --git a/crates/common/src/auth/authentication.rs b/crates/common/src/auth/authentication.rs
index 45416bc3..96c03e45 100644
--- a/crates/common/src/auth/authentication.rs
+++ b/crates/common/src/auth/authentication.rs
@@ -342,11 +342,7 @@ impl Server {
                             return self.build_directory_token(result, req.remote_ip).await;
                         }
                         Err(err) => {
-                            if !err.matches(trc::EventType::Auth(trc::AuthEvent::Failed)) {
-                                return Err(err);
-                            } else {
-                                external_error = Some(err);
-                            }
+                            external_error = Some(err);
                         }
                     }
                 }