diff --git a/Makefile b/Makefile
index a47b3f0f66a..c3aa106cf3e 100644
--- a/Makefile
+++ b/Makefile
@@ -142,9 +142,11 @@ lint-install:
 	$(UV) sync --inexact --frozen --group proxy-dev --group e2e-dev
 	$(UV_RUN) python scripts/prisma_generate_if_needed.py
 
-# Diff-scoped format check, identical to test-linting.yml's "Check ruff format" step:
+# Diff-scoped format check, mirroring test-linting.yml's "Check ruff format" step:
 # only the litellm Python files changed vs the base are checked, so a pre-existing
-# format issue elsewhere doesn't block an unrelated commit.
+# format issue elsewhere doesn't block an unrelated commit. Git pathspecs match
+# recursively, so 'litellm/*.py' covers nested modules and the top-level files that
+# CI's 'litellm/**/*.py' skips, which makes this target a superset of the CI step.
 lint-format-check-changed: $(LINT_DEP_INSTALL) $(LINT_DEP_BASE)
 	@files=$$(git diff --name-only --diff-filter=ACMR origin/litellm_internal_staging...HEAD -- 'litellm/*.py' | grep -v '^litellm/enterprise/' || true); \
 	if [ -z "$$files" ]; then \
diff --git a/tests/test_litellm/litellm_core_utils/test_cli_token_utils.py b/tests/test_litellm/litellm_core_utils/test_cli_token_utils.py
index e78add61dd5..357d3ae1b10 100644
--- a/tests/test_litellm/litellm_core_utils/test_cli_token_utils.py
+++ b/tests/test_litellm/litellm_core_utils/test_cli_token_utils.py
@@ -870,6 +870,15 @@ class TestIsCliTokenFresh:
 
         assert is_cli_token_fresh(almost, buffer_hours=0.1) is False
 
+    def test_a_stamp_left_in_the_future_keeps_reporting_fresh_until_the_clock_catches_up(self):
+        """The stamp both orders the two stores and drives this shortcut, so a store left stamped
+        ahead of the clock hands that stamp to the next sign-in and keeps it looking fresh past the
+        expiry the gateway will actually enforce. Pinning that here so the shared stamp cannot stop
+        being a deliberate trade without this failing first."""
+        ahead = CliTokenRecord(timestamp=time.time() + CLI_JWT_EXPIRATION_HOURS * 3600)
+
+        assert is_cli_token_fresh(ahead) is True
+
 
 class _FakeKeyringModule:
     def __init__(self, stored=None, *, get_error=None, set_error=None, delete_error=None, discard=False):