diff --git a/plugins/credentialhelper/store.go b/plugins/credentialhelper/store.go
index 6d27bbbe..357c7ded 100644
--- a/plugins/credentialhelper/store.go
+++ b/plugins/credentialhelper/store.go
@@ -129,7 +129,7 @@ func (s *credentialHelperStore) GetSecrets(_ context.Context, pattern plugin.Pat
 
 func (s *credentialHelperStore) Run(ctx context.Context) error {
 	<-ctx.Done()
-	return nil
+	return ctx.Err()
 }
 
 var _ plugin.Plugin = &credentialHelperStore{}
diff --git a/plugins/credentialhelper/store_test.go b/plugins/credentialhelper/store_test.go
index c788cd21..c7be93e3 100644
--- a/plugins/credentialhelper/store_test.go
+++ b/plugins/credentialhelper/store_test.go
@@ -15,6 +15,7 @@
 package credentialhelper
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -219,6 +220,32 @@ func TestCredentialHelper(t *testing.T) {
 	})
 }
 
+func TestRun(t *testing.T) {
+	t.Run("returns context cancelled when context is cancelled", func(t *testing.T) {
+		c, err := New(testhelper.TestLogger(t),
+			WithShellProgramFunc(func(args ...string) client.Program {
+				return &mockCredentialHelper{
+					t:         t,
+					operation: args[0],
+					store:     map[string]credentials.Credentials{},
+				}
+			}),
+		)
+		require.NoError(t, err)
+
+		ctx, cancel := context.WithCancel(t.Context())
+
+		done := make(chan error, 1)
+		go func() {
+			done <- c.Run(ctx)
+		}()
+
+		cancel()
+
+		require.ErrorIs(t, <-done, context.Canceled)
+	})
+}
+
 func TestDefaultKeyRewriter(t *testing.T) {
 	for _, tc := range []struct {
 		desc      string