diff --git a/pkg/bootstrap/chain.go b/pkg/bootstrap/chain.go
index 7b36f6a23d2ba..a0bb85aa3471c 100644
--- a/pkg/bootstrap/chain.go
+++ b/pkg/bootstrap/chain.go
@@ -44,6 +44,9 @@ func (v *ChainVerifier) VerifyToken(ctx context.Context, rawRequest *http.Reques
 		if err == ErrNotThisVerifier {
 			continue
 		}
+		if err == ErrAlreadyExists {
+			return nil, ErrAlreadyExists
+		}
 		klog.Infof("failed to verify token: %v", err)
 	}
 	return nil, fmt.Errorf("unable to verify token")
diff --git a/pkg/kopscontrollerclient/client.go b/pkg/kopscontrollerclient/client.go
index 34371659b1439..24c3a5cfec74e 100644
--- a/pkg/kopscontrollerclient/client.go
+++ b/pkg/kopscontrollerclient/client.go
@@ -125,3 +125,9 @@ func (b *Client) Query(ctx context.Context, req any, resp any) error {
 
 	return json.NewDecoder(response.Body).Decode(resp)
 }
+
+func (b *Client) Close() {
+	if b.httpClient != nil {
+		b.httpClient.CloseIdleConnections()
+	}
+}
diff --git a/upup/pkg/fi/nodeup/command.go b/upup/pkg/fi/nodeup/command.go
index e7cdbece3f71b..d628dee654337 100644
--- a/upup/pkg/fi/nodeup/command.go
+++ b/upup/pkg/fi/nodeup/command.go
@@ -699,6 +699,7 @@ func getNodeConfigFromServers(ctx context.Context, bootConfig *nodeup.BootConfig
 		Authenticator: authenticator,
 		CAs:           []byte(bootConfig.ConfigServer.CACertificates),
 	}
+	defer client.Close()
 
 	var merr error
 	for _, server := range bootConfig.ConfigServer.Servers {