diff --git a/pkg/iam/session_service.go b/pkg/iam/session_service.go
index 312145894..121ff05ee 100644
--- a/pkg/iam/session_service.go
+++ b/pkg/iam/session_service.go
@@ -300,6 +300,14 @@ func (s SessionService) GetActiveSessionForMembership(ctx context.Context, rootS
 				return fmt.Errorf("cannot load child session: %w", err)
 			}
 
+			if childSession.ExpireReason != nil {
+				return NewSessionExpiredError(childSession.ID)
+			}
+
+			if time.Now().After(childSession.ExpiredAt) {
+				return NewSessionExpiredError(childSession.ID)
+			}
+
 			return nil
 		},
 	)
diff --git a/pkg/server/api/connect/v1/v1_resolver.go b/pkg/server/api/connect/v1/v1_resolver.go
index 816a46809..0ceca4aec 100644
--- a/pkg/server/api/connect/v1/v1_resolver.go
+++ b/pkg/server/api/connect/v1/v1_resolver.go
@@ -144,9 +144,12 @@ func (r *membershipResolver) ActiveSession(ctx context.Context, obj *types.Membe
 
 	session, err := r.iam.SessionService.GetActiveSessionForMembership(ctx, rootSession.UserID, obj.ID)
 	if err != nil {
-		var errSessionNotFound *iam.ErrSessionNotFound
+		var (
+			errSessionNotFound *iam.ErrSessionNotFound
+			errSessionExpired  *iam.ErrSessionExpired
+		)
 
-		if errors.As(err, &errSessionNotFound) {
+		if errors.As(err, &errSessionNotFound) || errors.As(err, &errSessionExpired) {
 			return nil, nil
 		}