Using TokenRelay the OAuth2AuthenticationToken in controllers is never updated

I use the TokenRelay filter and added a very basic controller to reflect the TokenRelay's authentication status on the client.

What I observe is, that the OAuth 2.0 client behaviour of the relay filter is correct and the downstream service receives up to date tokens. After the session expired, the downstream service will correctly try to establish a new login.

But throughout the whole session the Gateway's controller will only see the very first OAuth2AuthenticationToken object. Although the tokens the relay passes downstream are up to date, the OAuth2AuthenticationToken is not. The idToken within is always only the very first after successful authentication and never updated.

My controller (in gateway)

@RestController
public class Controller {

    @GetMapping(path = "/me", produces = "application/json")
    public Mono<User> user(@AuthenticationPrincipal Authentication auth) {

        if (auth instanceof OAuth2AuthenticationToken oauth
                && oauth.isAuthenticated()
                && oauth.getPrincipal() instanceof OidcUser principal) {

            principal.getIdToken(); // <!-- never updated

            var name = principal.getClaims().get("preferred_username");
            return Mono.just(new User(name.toString()));
        }
        return Mono.just(User.ANONYMOUS);
    }

    record User(String name) {
        static final User ANONYMOUS = new User("");
    }

}

My gateway configuration

spring:
  security:
    oauth2:
      client:
        registration:
          kc:
            provider: kc
            client-id: signapp
            client-secret: <secret>
            authorization-grant-type: authorization_code
            scope: openid
        provider:
          kc:
            issuer-uri: <keycloak realm>

  cloud:
    gateway:
      routes:
        - id: api
          uri: http://localhost:8080
          predicates:
            - Path=/**
          filters:
            - TokenRelay=

Minimal reproducing repo: https://github.com/fabian-dev/scg-auth-not-updated/blob/main/src/main/java/scg/authnotupdated/Controller.java

Start with the reproducer's src/main/java/scg/authnotupdated/Controller.java and its /me endpoint, then trace the TokenRelay filter alongside OAuth2AuthenticationToken and OidcUser. Done means the gateway controller observes the current authentication and ID token after the session is renewed, while downstream token relay behavior remains correct.