After enabling refresh tokens on our oidc backend (shout out to @harrisonfritz), dask-kubernetes still failed. I narrowed down the problem to the fact that parse_rfc3339 is not equipped to handle an expiration_timestamp in epoch string format, which is what the OIDC protocol spec specifies (shout out to @DWSR for pointing us to the relevant docs):

exp
REQUIRED. Expiration time on or after which the ID Token MUST NOT be accepted for processing. The processing of this parameter requires that the current date/time MUST be before the expiration date/time listed in the value. Implementers MAY provide for some small leeway, usually no more than a few minutes, to account for clock skew. Its value is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z as measured in UTC until the date/time. See RFC 3339 [RFC3339] for details regarding date/times in general and UTC in particular.

Emphasis mine. I manually validated that this works on our end. Not sure why no one has run into it before. Perhaps the oidc auth path is not widely adopted or most people are invoking it in-cluster (where the service account token is consumed).