diff --git a/private/buf/cmd/buf/buf.go b/private/buf/cmd/buf/buf.go
index 9e399347ba..c4f73f028e 100644
--- a/private/buf/cmd/buf/buf.go
+++ b/private/buf/cmd/buf/buf.go
@@ -289,7 +289,8 @@ func wrapError(err error) error {
 				"visit https://docs.buf.build/bsr/authentication`, authErr.TokenEnvKey())
 			}
 			return errors.New(`Failure: you are not authenticated. Create a new entry in your netrc, " +
-			"using a Buf API Key as the password. For details, visit https://docs.buf.build/bsr/authentication`)
+				"using a Buf API Key as the password. If you already have an entry in your netrc, check " +
+				"to see that your token is not expired. For details, visit https://docs.buf.build/bsr/authentication`)
 		case connectCode == connect.CodeUnavailable:
 			msg := `Failure: the server hosted at that remote is unavailable.`
 			// If the returned error is Unavailable, then determine if this is a DNS error.  If so,