diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4f2c1ef2..499dda19 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- Recreate REST client after starting a workspace to ensure fresh TLS certificates.
+
 ## [v1.3.10](https://github.com/coder/vscode-coder/releases/tag/v1.3.9) (2025-01-17)
 
 - Fix bug where checking for overridden properties incorrectly converted host name pattern to regular expression.
diff --git a/src/remote.ts b/src/remote.ts
index abe93e1f..403642a0 100644
--- a/src/remote.ts
+++ b/src/remote.ts
@@ -56,11 +56,6 @@ export class Remote {
     label: string,
     binPath: string,
   ): Promise<Workspace | undefined> {
-    // Maybe already running?
-    if (workspace.latest_build.status === "running") {
-      return workspace
-    }
-
     const workspaceName = `${workspace.owner_name}/${workspace.name}`
 
     // A terminal will be used to stream the build, if one is necessary.
@@ -320,13 +315,19 @@ export class Remote {
     disposables.push(this.registerLabelFormatter(remoteAuthority, workspace.owner_name, workspace.name))
 
     // If the workspace is not in a running state, try to get it running.
-    const updatedWorkspace = await this.maybeWaitForRunning(workspaceRestClient, workspace, parts.label, binaryPath)
-    if (!updatedWorkspace) {
-      // User declined to start the workspace.
-      await this.closeRemote()
+    if (workspace.latest_build.status !== "running") {
+      if (!(await this.maybeWaitForRunning(workspaceRestClient, workspace, parts.label, binaryPath))) {
+        // User declined to start the workspace.
+        await this.closeRemote()
+      } else {
+        // Start over with a fresh REST client because we may have waited an
+        // indeterminate amount amount of time for confirmation to start the
+        // workspace.
+        await this.setup(remoteAuthority)
+      }
       return
     }
-    this.commands.workspace = workspace = updatedWorkspace
+    this.commands.workspace = workspace
 
     // Pick an agent.
     this.storage.writeToCoderOutputChannel(`Finding agent for ${workspaceName}...`)