Ocassionally, google backend fail

I've a cron on two machines that syncs all my calendars, including a single google calendar one:

 0	*	*	*	*	chronic vdirsyncer -v DEBUG sync

For some reason, I get a few emails a day for 401 errors. The odd thing is:

• Which machine fails varies.
• They fail only from time to time.

The full debug output is here.

My configuration:

[general]
status_path = "~/.local/share/vdirsyncer/status/"

##### Contacts ######

[pair contacts]
a = "contacts_local"
b = "contacts_fastmail"
collections = null
metadata = []
conflict_resolution = ["command", "vimdiff"]

[storage contacts_local]
type = "filesystem"
path = "~/.local/share/contacts/cards/"
fileext = ".vcf"

[storage contacts_fastmail]
type = "carddav"
url = "https://carddav.messagingengine.com/dav/addressbooks/user/hobarrera@fastmail.com/Default/"
username = "hobarrera@fastmail.com"
password.fetch = ["command", "~/.local/bin/vdirsyncer-pass", "fastmail:carddav"]

##### Calendars ######

[pair calendars]
a = "calendars_local"
b = "calendars_fastmail"
collections = ["from b"]
metadata = ["color", "displayname"]
conflict_resolution = ["command", "vimdiff"]

[storage calendars_local]
type = "filesystem"
path = "~/.local/share/calendars/"
fileext = ".ics"

[storage calendars_fastmail]
type = "caldav"
url = "https://caldav.messagingengine.com/"
username = "hobarrera@fastmail.com"
password.fetch = ["command", "~/.local/bin/vdirsyncer-pass", "fastmail:caldav"]

##### Work Calendars #####

[pair work_calendars]
a = "calendars_local"
b = "calendars_google"
collections = ["hbarrera@shiftgig.com"]
metadata = ["color", "displayname"]
conflict_resolution = ["command", "vimdiff"]

[storage calendars_google]
type = "google_calendar"
token_file = "~/.cache/vdirsyncer/google.token"
client_id = "1066339489224-5v10lce8q2i7d4ivo441bjus5d3178uu.apps.googleusercontent.com"
client_secret = "REDACTED"

Start with the linked full debug output and the google_calendar storage configuration, including token_file and the scheduled sync command. Trace the intermittent 401 responses across both machines and determine the authentication failure; done means the cause and a reliable resolution or handling strategy are documented and verified.