diff --git a/src/api.ts b/src/api.ts
index f6f59ba8..c5d75e37 100644
--- a/src/api.ts
+++ b/src/api.ts
@@ -13,6 +13,8 @@ import { getProxyForUrl } from "./proxy"
 import { Storage } from "./storage"
 import { expandPath } from "./util"
 
+export const coderSessionTokenHeader = "Coder-Session-Token"
+
 /**
  * Return whether the API will need a token for authorization.
  * If mTLS is in use (as specified by the cert or key files being set) then
@@ -242,14 +244,15 @@ export async function waitForBuild(
       const baseUrl = new URL(baseUrlRaw)
       const proto = baseUrl.protocol === "https:" ? "wss:" : "ws:"
       const socketUrlRaw = `${proto}//${baseUrl.host}${path}`
+      const token = restClient.getAxiosInstance().defaults.headers.common[coderSessionTokenHeader] as string | undefined
       const socket = new ws.WebSocket(new URL(socketUrlRaw), {
-        headers: {
-          "Coder-Session-Token": restClient.getAxiosInstance().defaults.headers.common["Coder-Session-Token"] as
-            | string
-            | undefined,
-        },
-        followRedirects: true,
         agent: agent,
+        followRedirects: true,
+        headers: token
+          ? {
+              [coderSessionTokenHeader]: token,
+            }
+          : undefined,
       })
       socket.binaryType = "nodebuffer"
       socket.on("message", (data) => {
diff --git a/src/inbox.ts b/src/inbox.ts
index 34a87a5e..f682273e 100644
--- a/src/inbox.ts
+++ b/src/inbox.ts
@@ -3,6 +3,7 @@ import { Workspace, GetInboxNotificationResponse } from "coder/site/src/api/type
 import { ProxyAgent } from "proxy-agent"
 import * as vscode from "vscode"
 import { WebSocket } from "ws"
+import { coderSessionTokenHeader } from "./api"
 import { errToStr } from "./api-helper"
 import { type Storage } from "./storage"
 
@@ -37,15 +38,15 @@ export class Inbox implements vscode.Disposable {
     const socketProto = baseUrl.protocol === "https:" ? "wss:" : "ws:"
     const socketUrl = `${socketProto}//${baseUrl.host}/api/v2/notifications/inbox/watch?format=plaintext&templates=${watchTemplatesParam}&targets=${watchTargetsParam}`
 
-    const coderSessionTokenHeader = "Coder-Session-Token"
+    const token = restClient.getAxiosInstance().defaults.headers.common[coderSessionTokenHeader] as string | undefined
     this.#socket = new WebSocket(new URL(socketUrl), {
-      followRedirects: true,
       agent: httpAgent,
-      headers: {
-        [coderSessionTokenHeader]: restClient.getAxiosInstance().defaults.headers.common[coderSessionTokenHeader] as
-          | string
-          | undefined,
-      },
+      followRedirects: true,
+      headers: token
+        ? {
+            [coderSessionTokenHeader]: token,
+          }
+        : undefined,
     })
 
     this.#socket.on("open", () => {