Seems like I was able to work around it (or I'm now setting the provider correctly). Basically what I changed was explicitly initializing the provider for the stack (I am using Golang, for reference), and use it to create all resources in the stack. Now whenever I try to apply or destroy any changes, it correctly refreshes the token