diff --git a/metropolis/node/kubernetes/authproxy/authproxy.go b/metropolis/node/kubernetes/authproxy/authproxy.go
index e8e6fd8..c4a844e 100644
--- a/metropolis/node/kubernetes/authproxy/authproxy.go
+++ b/metropolis/node/kubernetes/authproxy/authproxy.go
@@ -56,6 +56,9 @@
 
 	k8sCAs := x509.NewCertPool()
 	cert, _, err := s.KPKI.Certificate(ctx, pki.IdCA)
+	if err != nil {
+		return fmt.Errorf("could not load certificate %q from PKI: %w", pki.IdCA, err)
+	}
 	parsedCert, err := x509.ParseCertificate(cert)
 	if err != nil {
 		return fmt.Errorf("failed to parse K8s CA certificate: %w", err)