The mechanisms regulating exhaustion of tumor-infiltrating lymphocytes (TIL) and responsiveness to PD-1 blockade remain partly unknown. In human ovarian cancer, we show that tumor-specific CD8 ⁺ TIL accumulate in tumor islets, where they engage antigen and upregulate PD-1, which restrains their functions. Intraepithelial PD-1 ⁺ CD8 ⁺ TIL can be, however, polyfunctional. PD-1 ⁺ TIL indeed exhibit a continuum of exhaustion states, with variable levels of CD28 costimulation, which is provided by antigen-presenting cells (APC) in intraepithelial tumor myeloid niches. CD28 costimulation is associated with improved effector fitness of exhausted CD8 ⁺ TIL and is required for their activation upon PD-1 blockade, which also requires tumor myeloid APC. Exhausted TIL lacking proper CD28 costimulation in situ fail to respond to PD-1 blockade, and their response may be rescued by local CTLA-4 blockade and tumor APC stimulation via CD40L.