diff --git a/lib/galaxy/authnz/psa_authnz.py b/lib/galaxy/authnz/psa_authnz.py
index 706c7fc2d60..853b75ee6d2 100644
--- a/lib/galaxy/authnz/psa_authnz.py
+++ b/lib/galaxy/authnz/psa_authnz.py
@@ -518,6 +518,8 @@ def decode_access_token(social: UserAuthnzToken, backend: OpenIdConnectAuth, **k
     which should be handled by social_core.pipeline.social_auth.load_extra_data, so
     this step should be placed after load_extra_data in the pipeline.
     """
+    if social.extra_data is None:
+        return {"access_token": None}
     access_token_encoded = social.extra_data.get("access_token")
     if access_token_encoded is None:
         return {"access_token": None}
diff --git a/test/integration/oidc/test_auth_oidc.py b/test/integration/oidc/test_auth_oidc.py
index 3351a5f8c41..01fe0ac514e 100644
--- a/test/integration/oidc/test_auth_oidc.py
+++ b/test/integration/oidc/test_auth_oidc.py
@@ -114,6 +114,7 @@ class AbstractTestCases:
         container_name: ClassVar[str]
         backend_config_file: ClassVar[str]
         provider_name: ClassVar[str]
+        random_port: ClassVar[int]
         saved_oauthlib_insecure_transport: ClassVar[bool]
 
         @classmethod
@@ -421,6 +422,8 @@ class TestGalaxyOIDCLoginPSA(AbstractTestCases.BaseKeycloakIntegrationTestCase):
         sa_session = self._app.model.session
         user = sa_session.query(model.User).filter_by(email="gxyuser@galaxy.org").one()
         social = next((s for s in user.social_auth if s.provider == "oidc"), None)
+        assert social is not None
         extra_data = social.extra_data
+        assert extra_data is not None
         assert "access_token_decoded" in extra_data
         assert "realm_access" in extra_data["access_token_decoded"]
diff --git a/test/unit/authnz/test_psa_authnz.py b/test/unit/authnz/test_psa_authnz.py
index b5d52a80c1c..b29981a10cc 100644
--- a/test/unit/authnz/test_psa_authnz.py
+++ b/test/unit/authnz/test_psa_authnz.py
@@ -7,6 +7,7 @@ from datetime import (
     datetime,
     timedelta,
 )
+from typing import Optional
 from unittest.mock import MagicMock
 
 import jwt
@@ -98,15 +99,15 @@ class AuthTokenData:
 
 def create_access_token(
     email: str = "user@example.com",
-    roles: list[str] = None,
+    roles: Optional[list[str]] = None,
     iss: str = "https://issuer.example.com",
-    sub: str = None,
-    iat: int = None,
-    exp: int = None,
+    sub: Optional[str] = None,
+    iat: Optional[int] = None,
+    exp: Optional[int] = None,
     aud: str = "https://audience.example.com",
-    scope: list[str] = None,
-    azp: str = None,
-    permissions: list[str] = None,
+    scope: Optional[list[str]] = None,
+    azp: Optional[str] = None,
+    permissions: Optional[list[str]] = None,
     algorithm: str = "RS256",
     public_key_id: str = "example-key",
 ) -> AuthTokenData: