diff --git a/apps/portal/src/app/app.module.ts b/apps/portal/src/app/app.module.ts
index a46e78825..f1d1b4c97 100644
--- a/apps/portal/src/app/app.module.ts
+++ b/apps/portal/src/app/app.module.ts
@@ -6,11 +6,10 @@ import { BrowserModule } from '@angular/platform-browser';
 import { BrowserAnimationsModule } from '@angular/platform-browser/animations';
 import { RouterModule } from '@angular/router';
 import { ZenAuthModule } from '@zen/auth';
-import { Environment, HttpRequestInterceptor } from '@zen/common';
+import { Environment, HttpRequestInterceptor, tokenVar } from '@zen/common';
 import { ZenGraphQLModule } from '@zen/graphql';
 import { possibleTypes, typePolicies } from '@zen/graphql/client';
 import { MainModule } from '@zen/main';
-import ls from 'localstorage-slim';
 
 import { environment } from '../environments/environment';
 import { AppComponent } from './app.component';
@@ -44,7 +43,7 @@ import { AppComponent } from './app.component';
         uri: environment.url.graphqlSubscriptions,
         options: {
           reconnect: true,
-          connectionParams: () => ({ token: ls.get('token', { decrypt: true }) }),
+          connectionParams: () => ({ token: tokenVar() }),
         },
       },
     }),
diff --git a/libs/auth/src/lib/auth.service.ts b/libs/auth/src/lib/auth.service.ts
index 0bd3e39fe..742557c06 100644
--- a/libs/auth/src/lib/auth.service.ts
+++ b/libs/auth/src/lib/auth.service.ts
@@ -1,6 +1,6 @@
 import { Injectable } from '@angular/core';
 import { Router } from '@angular/router';
-import { Environment } from '@zen/common';
+import { Environment, tokenVar } from '@zen/common';
 import {
   ApiError,
   AuthExchangeTokenGQL,
@@ -100,6 +100,8 @@ export class AuthService {
     ls.set(LocalStorageKey.rememberMe, authSession.rememberMe);
     ls.set(LocalStorageKey.roles, authSession.roles, { encrypt: true });
 
+    tokenVar(authSession.token);
+
     if (!this.rolesEqual(this.roles, authSession.roles)) {
       if (authSession.roles) userRolesVar(authSession.roles);
       else userRolesVar([]);
@@ -164,6 +166,7 @@ export class AuthService {
     ls.remove(LocalStorageKey.rememberMe);
     ls.remove(LocalStorageKey.roles);
     userRolesVar([]);
+    tokenVar(null);
     this.apollo.client.cache.reset();
     this.#graphqlSubscriptionClient$.next(null);
   }
diff --git a/libs/common/src/index.ts b/libs/common/src/index.ts
index 5e44ca549..38ac801bb 100644
--- a/libs/common/src/index.ts
+++ b/libs/common/src/index.ts
@@ -6,3 +6,4 @@ export * from './lib/nameof';
 export * from './lib/email-validator';
 export * from './lib/password-validator';
 export * from './lib/trim-object-strings';
+export * from './lib/token-var';
diff --git a/libs/common/src/lib/http-request-interceptor.ts b/libs/common/src/lib/http-request-interceptor.ts
index 0430cbad2..5069196df 100644
--- a/libs/common/src/lib/http-request-interceptor.ts
+++ b/libs/common/src/lib/http-request-interceptor.ts
@@ -4,6 +4,7 @@ import ls from 'localstorage-slim';
 import { Observable } from 'rxjs';
 
 import { Environment } from './environment';
+import { tokenVar } from './token-var';
 
 @Injectable()
 export class HttpRequestInterceptor implements HttpInterceptor {
@@ -16,7 +17,7 @@ export class HttpRequestInterceptor implements HttpInterceptor {
   }
 
   intercept(req: HttpRequest<any>, next: HttpHandler): Observable<HttpEvent<any>> {
-    const token = ls.get('token', { decrypt: true }) as string | undefined;
+    const token = tokenVar();
     const reqHost = new URL(req.url).host;
 
     if (token && (reqHost === this.apiHost || reqHost === this.gqlHost)) {
diff --git a/libs/common/src/lib/token-var.ts b/libs/common/src/lib/token-var.ts
new file mode 100644
index 000000000..51cd51fc7
--- /dev/null
+++ b/libs/common/src/lib/token-var.ts
@@ -0,0 +1,5 @@
+import { makeVar } from '@apollo/client/core';
+import ls from 'localstorage-slim';
+
+const token: string = ls.get('token', { decrypt: true }) ?? '';
+export const tokenVar = makeVar<string | null>(token);