diff --git a/browser/CHANGELOG.md b/browser/CHANGELOG.md
index a9bbd36c1..12b4ad9db 100644
--- a/browser/CHANGELOG.md
+++ b/browser/CHANGELOG.md
@@ -2,6 +2,12 @@
 
 This changelog covers all three packages, as they are (for now) updated as a whole
 
+## UNRELEASED
+
+### @tomic/lib
+
+- Always fetch all resources after setting + authenticating new agent with websockets #686
+
 ## v0.36.1
 
 ### @tomic/svelte
diff --git a/browser/lib/src/store.ts b/browser/lib/src/store.ts
index caeeddb8a..045a258ec 100644
--- a/browser/lib/src/store.ts
+++ b/browser/lib/src/store.ts
@@ -616,12 +616,14 @@ export class Store {
       }
 
       this.webSockets.forEach(ws => {
-        ws.readyState === ws.OPEN && authenticate(ws, this);
-      });
-
-      this.resources.forEach(r => {
-        if (r.isUnauthorized() || r.loading) {
-          this.fetchResourceFromServer(r.getSubject());
+        // If WebSocket is already open, authenticate immediately
+        if (ws.readyState === ws.OPEN) {
+          authenticate(ws, this, true);
+        } else {
+          // Otherwise, wait for it to open before authenticating
+          ws.onopen = () => {
+            authenticate(ws, this, true);
+          };
         }
       });
     } else {
diff --git a/browser/lib/src/websockets.ts b/browser/lib/src/websockets.ts
index 729b68160..7c784b3ce 100644
--- a/browser/lib/src/websockets.ts
+++ b/browser/lib/src/websockets.ts
@@ -64,7 +64,11 @@ function parseResourceMessage(ev: MessageEvent): Resource[] {
  * Authenticates current Agent over current WebSocket. Doesn't do anything if
  * there is no agent
  */
-export async function authenticate(client: WebSocket, store: Store) {
+export async function authenticate(
+  client: WebSocket,
+  store: Store,
+  fetchAll = false,
+) {
   const agent = store.getAgent();
 
   if (!agent || !agent.subject) {
@@ -84,6 +88,14 @@ export async function authenticate(client: WebSocket, store: Store) {
 
   const json = await createAuthentication(client.url, agent);
   client.send('AUTHENTICATE ' + JSON.stringify(json));
+
+  // Maybe this should happen after the authentication is confirmed?
+  fetchAll &&
+    this.resources.forEach(r => {
+      if (r.isUnauthorized() || r.loading) {
+        this.fetchResourceFromServer(r.getSubject());
+      }
+    });
 }
 
 const defaultTimeout = 5000;