diff --git a/runpod/rp_cli/main.py b/runpod/rp_cli/main.py
index 8943d9960..847d11cb1 100644
--- a/runpod/rp_cli/main.py
+++ b/runpod/rp_cli/main.py
@@ -718,7 +718,22 @@ def _read_code() -> str:
             )
         set_credentials(api_key, profile=profile, overwrite=True)
     except (LoginError, ValueError, OSError) as exc:
-        _fail(str(exc))
+        from runpod.rp_cli.update import cached_newer_version
+
+        newer = cached_newer_version()
+        upgrade_hint = (
+            f"\n\na newer runpod ({newer}) is available; "
+            "`pip install -U runpod` may fix this."
+            if newer
+            else ""
+        )
+        _fail(
+            f"{exc}\n\n"
+            "if rp login keeps failing, grab a key from "
+            "https://console.runpod.io/user/settings and run:\n"
+            "  rp login --api-key YOUR_KEY"
+            f"{upgrade_hint}"
+        )
     ui.success("logged in, credentials saved to [dim]~/.runpod/config.toml[/dim]")
 
 
diff --git a/runpod/rp_cli/update.py b/runpod/rp_cli/update.py
index 82258b7b1..96a8aff21 100644
--- a/runpod/rp_cli/update.py
+++ b/runpod/rp_cli/update.py
@@ -126,6 +126,19 @@ def run_install(version: str) -> None:
 # -- passive background check -------------------------------------------
 
 
+def cached_newer_version() -> Optional[str]:
+    """fresh cached latest release only if newer than current; None otherwise."""
+    cache = _read_cache()
+    if not cache or not _cache_fresh(cache):
+        return None
+    latest = cache.get("latest_version")
+    if not latest:
+        return None
+    if compare_versions(parse_version(latest), parse_version(current_version())) > 0:
+        return latest
+    return None
+
+
 def _read_cache() -> Optional[dict]:
     try:
         return json.loads(CACHE_PATH.read_text(encoding="utf-8"))