diff --git a/tests/base_sdk_tests/check_base_sdk_install.py b/tests/base_sdk_tests/check_base_sdk_install.py
index 723f30cad76..6b38de75e2e 100644
--- a/tests/base_sdk_tests/check_base_sdk_install.py
+++ b/tests/base_sdk_tests/check_base_sdk_install.py
@@ -11,7 +11,7 @@ import sys
 import traceback
 from collections.abc import Callable
 
-EXTRAS_ONLY_MODULES = ("fastapi", "uvicorn")
+EXTRAS_ONLY_MODULES = ("fastapi", "uvicorn", "keyring")
 
 
 def _require(condition: bool, message: str) -> None:
diff --git a/tests/test_litellm/proxy/client/cli/test_up_commands.py b/tests/test_litellm/proxy/client/cli/test_up_commands.py
index aebf441f777..a8d81f1c4bb 100644
--- a/tests/test_litellm/proxy/client/cli/test_up_commands.py
+++ b/tests/test_litellm/proxy/client/cli/test_up_commands.py
@@ -262,6 +262,28 @@ class TestEnsureFreshLogin:
 
         assert login_calls == ["http://proxy-b:4000"]
 
+    def test_forces_a_fresh_login_when_the_cached_token_has_no_readable_key(self, monkeypatch):
+        monkeypatch.setattr(up_module.sys.stdin, "isatty", lambda: True)
+        tokens = iter(
+            [
+                _token(None, "http://proxy-a:4000"),
+                _token("sk-a", "http://proxy-a:4000"),
+            ]
+        )
+        monkeypatch.setattr(up_module, "load_cli_token", lambda **_: next(tokens))
+        monkeypatch.setattr(up_module, "is_cli_token_fresh", lambda token_data: True)
+        login_calls = []
+
+        @click.pass_context
+        def fake_login(ctx):
+            login_calls.append(ctx.obj["base_url"])
+
+        monkeypatch.setattr(up_module, "login", fake_login)
+
+        _ensure_fresh_login(_make_ctx("http://proxy-a:4000"))
+
+        assert login_calls == ["http://proxy-a:4000"]
+
     def test_fails_cleanly_non_interactively_when_only_a_different_proxys_token_is_cached(self, monkeypatch):
         monkeypatch.setattr(up_module.sys.stdin, "isatty", lambda: False)
         monkeypatch.setattr(up_module, "load_cli_token", lambda **_: _token("sk-a", "http://proxy-a:4000"))