diff --git a/internal/pkg/config/v1/context_state.go b/internal/pkg/config/v1/context_state.go
index f55aa4b28c..8fc2f1c67e 100644
--- a/internal/pkg/config/v1/context_state.go
+++ b/internal/pkg/config/v1/context_state.go
@@ -2,6 +2,7 @@ package v1
 
 import (
 	"regexp"
+	"runtime"
 
 	"github.com/confluentinc/cli/internal/pkg/secret"
 )
@@ -21,7 +22,7 @@ type ContextState struct {
 
 func (c *ContextState) DecryptContextStateAuthToken(ctxName string) error {
 	reg := regexp.MustCompile(authTokenRegex)
-	if !reg.MatchString(c.AuthToken) && c.AuthToken != "" && c.Salt != nil {
+	if !reg.MatchString(c.AuthToken) && c.AuthToken != "" && (c.Salt != nil || runtime.GOOS == "windows") {
 		decryptedAuthToken, err := secret.Decrypt(ctxName, c.AuthToken, c.Salt, c.Nonce)
 		if err != nil {
 			return err
@@ -34,7 +35,7 @@ func (c *ContextState) DecryptContextStateAuthToken(ctxName string) error {
 
 func (c *ContextState) DecryptContextStateAuthRefreshToken(ctxName string) error {
 	reg := regexp.MustCompile(authRefreshTokenRegex)
-	if !reg.MatchString(c.AuthRefreshToken) && c.AuthRefreshToken != "" && c.Salt != nil {
+	if !reg.MatchString(c.AuthRefreshToken) && c.AuthRefreshToken != "" && (c.Salt != nil || runtime.GOOS == "windows") {
 		decryptedAuthRefreshToken, err := secret.Decrypt(ctxName, c.AuthRefreshToken, c.Salt, c.Nonce)
 		if err != nil {
 			return err