diff --git a/cmd/relayfile-cli/main.go b/cmd/relayfile-cli/main.go
index 9f0aa45b..efaf0f57 100644
--- a/cmd/relayfile-cli/main.go
+++ b/cmd/relayfile-cli/main.go
@@ -9859,6 +9859,15 @@ func loadDelegatedCredentials(path string) (delegatedauth.Bundle, string, error)
 }
 
 func loadDelegatedCredentialsForRequest(path, workspaceValue string, scopes []string) (delegatedauth.Bundle, string, error) {
+	if explicitPath, ok := explicitDelegatedCredentialsPath(path); ok {
+		return loadDelegatedCredentials(explicitPath)
+	}
+	if strings.TrimSpace(workspaceValue) == "" {
+		legacyBundle, legacyPath, legacyErr := loadDelegatedCredentials(delegatedCredentialsPath())
+		if legacyErr == nil && delegatedBundleSatisfiesRequestedScopes(legacyBundle, scopes) {
+			return legacyBundle, legacyPath, nil
+		}
+	}
 	canonicalWorkspaceValue, canonicalWorkspaceOK := canonicalWorkspaceShardValueStatus(workspaceValue)
 	if !canonicalWorkspaceOK && strings.TrimSpace(workspaceValue) != "" {
 		fmt.Fprintf(os.Stderr, "warning: delegated credential workspace %q was not uniquely resolved in %s; using raw workspace shard and probing alias shards\n", canonicalWorkspaceValue, workspacesPath())
diff --git a/cmd/relayfile-cli/main_test.go b/cmd/relayfile-cli/main_test.go
index 71b4e9c2..455fd6a6 100644
--- a/cmd/relayfile-cli/main_test.go
+++ b/cmd/relayfile-cli/main_test.go
@@ -1278,6 +1278,13 @@ func TestReadPrintsRemoteFileContent(t *testing.T) {
 func TestReadUsesTokenWorkspaceWhenWorkspaceArgOmitted(t *testing.T) {
 	t.Setenv("HOME", t.TempDir())
 	clearRelayfileEnv(t)
+	agentRelayLog := filepath.Join(t.TempDir(), "agent-relay.log")
+	t.Setenv("AGENT_RELAY_LOG", agentRelayLog)
+	installFakeAgentRelay(t, `
+printf '%s\n' "$*" >> "$AGENT_RELAY_LOG"
+echo "unexpected agent-relay call: $*" >&2
+exit 2
+`)
 
 	token := testJWTWithWorkspace("ws_token")
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -1306,6 +1313,9 @@ func TestReadUsesTokenWorkspaceWhenWorkspaceArgOmitted(t *testing.T) {
 	if got := stdout.String(); got != "ok\n" {
 		t.Fatalf("unexpected file content: %q", got)
 	}
+	if _, err := os.Stat(agentRelayLog); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("read with a token workspace unexpectedly called agent-relay: %v", err)
+	}
 }
 
 func TestReadDecodesBase64Content(t *testing.T) {