diff --git a/internal/client/transport/http_reader.go b/internal/client/transport/http_reader.go
index e0833e913..46577303e 100644
--- a/internal/client/transport/http_reader.go
+++ b/internal/client/transport/http_reader.go
@@ -165,7 +165,7 @@ func (hrs *HTTPReadSeeker) reset() {
 	}
 }
 
-func (hrs *HTTPReadSeeker) reader() (io.Reader, error) {
+func (hrs *HTTPReadSeeker) reader() (_ io.Reader, retErr error) {
 	if hrs.err != nil {
 		return nil, hrs.err
 	}
@@ -191,6 +191,11 @@ func (hrs *HTTPReadSeeker) reader() (io.Reader, error) {
 	if err != nil {
 		return nil, err
 	}
+	defer func() {
+		if retErr != nil {
+			_ = resp.Body.Close()
+		}
+	}()
 
 	// Normally would use client.SuccessStatus, but that would be a cyclic
 	// import
@@ -276,8 +281,11 @@ func (hrs *HTTPReadSeeker) reader() (io.Reader, error) {
 
 		hrs.rc = body
 	} else {
-		defer resp.Body.Close()
 		if hrs.errorHandler != nil {
+			// Closing the body should be handled by the existing defer,
+			// but in case a custom "errHandler" is used that doesn't return
+			// an error, we close the body regardless.
+			defer resp.Body.Close()
 			return nil, hrs.errorHandler(resp)
 		}
 		return nil, fmt.Errorf("unexpected status resolving reader: %v", resp.Status)