diff --git a/metropolis/node/core/curator/impl_leader_certificates.go b/metropolis/node/core/curator/impl_leader_certificates.go
index cb11b99..9a3a427 100644
--- a/metropolis/node/core/curator/impl_leader_certificates.go
+++ b/metropolis/node/core/curator/impl_leader_certificates.go
@@ -41,6 +41,10 @@
 	}
 
 	csiClient, err := kp.CSIProvisioner(ctx, nodeID, req.CsiProvisionerPubkey)
+	if err != nil {
+		return nil, status.Errorf(codes.Unavailable, "could not generate CSI provisioner certificates: %v", err)
+	}
+
 	csiClientCert, err := csiClient.Ensure(ctx, kp.KV)
 	if err != nil {
 		return nil, status.Errorf(codes.Unavailable, "could not ensure CSI provisioner client certificate: %v", err)