diff --git a/pkg/controlplane/apiserver/config.go b/pkg/controlplane/apiserver/config.go
index 42eefb4a861..d3da39d629a 100644
--- a/pkg/controlplane/apiserver/config.go
+++ b/pkg/controlplane/apiserver/config.go
@@ -95,7 +95,9 @@ type Extra struct {
 	VersionedInformers clientgoinformers.SharedInformerFactory
 }
 
-// BuildGenericConfig takes the master server options and produces the genericapiserver.Config associated with it
+// BuildGenericConfig takes the generic controlplane apiserver options and produces
+// the genericapiserver.Config associated with it. The genericapiserver.Config is
+// often shared between multiple delegated apiservers.
 func BuildGenericConfig(
 	s controlplaneapiserver.CompletedOptions,
 	schemes []*runtime.Scheme,
@@ -130,7 +132,7 @@ func BuildGenericConfig(
 	kubeClientConfig := genericConfig.LoopbackClientConfig
 	clientgoExternalClient, err := clientgoclientset.NewForConfig(kubeClientConfig)
 	if err != nil {
-		lastErr = fmt.Errorf("failed to create real external clientset: %v", err)
+		lastErr = fmt.Errorf("failed to create real external clientset: %w", err)
 		return
 	}
 	versionedInformers = clientgoinformers.NewSharedInformerFactory(clientgoExternalClient, 10*time.Minute)
@@ -203,7 +205,7 @@ func BuildGenericConfig(
 		versionedInformers,
 	)
 	if err != nil {
-		lastErr = fmt.Errorf("invalid authorization config: %v", err)
+		lastErr = fmt.Errorf("invalid authorization config: %w", err)
 		return
 	}
 	if s.Authorization != nil && !enablesRBAC {
diff --git a/pkg/controlplane/apiserver/server.go b/pkg/controlplane/apiserver/server.go
index 31875d68dea..9e426062240 100644
--- a/pkg/controlplane/apiserver/server.go
+++ b/pkg/controlplane/apiserver/server.go
@@ -133,7 +133,10 @@ func (c completedConfig) New(name string, delegationTarget genericapiserver.Dele
 		VersionedInformers:        c.VersionedInformers,
 	}
 
-	client := kubernetes.NewForConfigOrDie(s.GenericAPIServer.LoopbackClientConfig)
+	client, err := kubernetes.NewForConfig(s.GenericAPIServer.LoopbackClientConfig)
+	if err != nil {
+		return nil, err
+	}
 	if len(c.SystemNamespaces) > 0 {
 		s.GenericAPIServer.AddPostStartHookOrDie("start-system-namespaces-controller", func(hookContext genericapiserver.PostStartHookContext) error {
 			go systemnamespaces.NewController(c.SystemNamespaces, client, s.VersionedInformers.Core().V1().Namespaces()).Run(hookContext.StopCh)