Per-user envelope encryption already protects your tokens. Add automatic key rotation on a regular schedule for defence in depth.