diff --git a/python/src/trezorlib/cli/__init__.py b/python/src/trezorlib/cli/__init__.py
index 498b58522b..f072c67cad 100644
--- a/python/src/trezorlib/cli/__init__.py
+++ b/python/src/trezorlib/cli/__init__.py
@@ -144,7 +144,12 @@ class TrezorConnection:
             if must_resume:
                 if session.id != self.session_id or session.id is None:
                     click.echo("Failed to resume session")
-                    RuntimeError("Failed to resume session - no session id provided")
+                    env_var = os.environ.get("TREZOR_SESSION_ID")
+                    if env_var and bytes.fromhex(env_var) == self.session_id:
+                        click.echo(
+                            "Session-id stored in TREZOR_SESSION_ID is no longer valid. Call 'unset TREZOR_SESSION_ID' to clear it."
+                        )
+                    raise exceptions.FailedSessionResumption()
             return session
 
         features = client.protocol.get_features()
@@ -271,6 +276,8 @@ class TrezorConnection:
         except transport.DeviceIsBusy:
             click.echo("Device is in use by another process.")
             sys.exit(1)
+        except exceptions.FailedSessionResumption:
+            sys.exit(1)
         except Exception:
             click.echo("Failed to find a Trezor device.")
             if self.path is not None:
@@ -312,17 +319,19 @@ def with_session(
         def function_with_session(
             obj: TrezorConnection, *args: "P.args", **kwargs: "P.kwargs"
         ) -> "R":
+            is_resume_mandatory = must_resume or obj.session_id is not None
+
             with obj.session_context(
                 empty_passphrase=empty_passphrase,
                 derive_cardano=derive_cardano,
                 seedless=seedless,
-                must_resume=must_resume,
+                must_resume=is_resume_mandatory,
             ) as session:
                 try:
                     return func(session, *args, **kwargs)
 
                 finally:
-                    if not must_resume:
+                    if not is_resume_mandatory:
                         session.end()
 
         return function_with_session
diff --git a/python/src/trezorlib/exceptions.py b/python/src/trezorlib/exceptions.py
index 87c04e7e6e..0d0ab892ed 100644
--- a/python/src/trezorlib/exceptions.py
+++ b/python/src/trezorlib/exceptions.py
@@ -85,3 +85,10 @@ class UnexpectedMessageError(TrezorException):
         self.expected = expected
         self.actual = actual
         super().__init__(f"Expected {expected.__name__} but Trezor sent {actual}")
+
+
+class FailedSessionResumption(TrezorException):
+    """Provided session_id is not valid / session cannot be resumed.
+
+    Raised when `trezorctl -s <sesssion_id>` is used or `TREZOR_SESSION_ID = <session_id>`
+    is set and resumption of session with the `session_id` fails."""