diff --git a/staging/src/k8s.io/client-go/plugin/pkg/client/auth/gcp/gcp.go b/staging/src/k8s.io/client-go/plugin/pkg/client/auth/gcp/gcp.go
index 142ffdd50eb..f5d2899d91f 100644
--- a/staging/src/k8s.io/client-go/plugin/pkg/client/auth/gcp/gcp.go
+++ b/staging/src/k8s.io/client-go/plugin/pkg/client/auth/gcp/gcp.go
@@ -124,10 +124,7 @@ func newGCPAuthProvider(_ string, gcpConfig map[string]string, persister restcli
 }
 
 func (g *gcpAuthProvider) WrapTransport(rt http.RoundTripper) http.RoundTripper {
-	return &oauth2.Transport{
-		Source: g.tokenSource,
-		Base:   rt,
-	}
+	return &conditionalTransport{&oauth2.Transport{Source: g.tokenSource, Base: rt}}
 }
 
 func (g *gcpAuthProvider) Login() error { return nil }
@@ -284,3 +281,14 @@ func parseJSONPath(input interface{}, name, template string) (string, error) {
 	}
 	return buf.String(), nil
 }
+
+type conditionalTransport struct {
+	oauthTransport *oauth2.Transport
+}
+
+func (t *conditionalTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	if len(req.Header.Get("Authorization")) != 0 {
+		return t.oauthTransport.Base.RoundTrip(req)
+	}
+	return t.oauthTransport.RoundTrip(req)
+}