diff --git a/staging/src/k8s.io/client-go/transport/websocket/roundtripper.go b/staging/src/k8s.io/client-go/transport/websocket/roundtripper.go
index 624dd5473a1..8286a8eb529 100644
--- a/staging/src/k8s.io/client-go/transport/websocket/roundtripper.go
+++ b/staging/src/k8s.io/client-go/transport/websocket/roundtripper.go
@@ -111,6 +111,10 @@ func (rt *RoundTripper) RoundTrip(request *http.Request) (retResp *http.Response
 	wsConn, resp, err := dialer.DialContext(request.Context(), request.URL.String(), request.Header)
 	if err != nil {
 		if errors.Is(err, gwebsocket.ErrBadHandshake) {
+			// Enhance the error message with the response status if possible.
+			if resp != nil && len(resp.Status) > 0 {
+				err = fmt.Errorf("%w (%s)", err, resp.Status)
+			}
 			return nil, &httpstream.UpgradeFailureError{Cause: err}
 		}
 		return nil, err
diff --git a/staging/src/k8s.io/client-go/transport/websocket/roundtripper_test.go b/staging/src/k8s.io/client-go/transport/websocket/roundtripper_test.go
index 39baba4b3ec..c03565d1a4f 100644
--- a/staging/src/k8s.io/client-go/transport/websocket/roundtripper_test.go
+++ b/staging/src/k8s.io/client-go/transport/websocket/roundtripper_test.go
@@ -87,7 +87,8 @@ func TestWebSocketRoundTripper_RoundTripperFails(t *testing.T) {
 	_, err = rt.RoundTrip(req)
 	// Ensure a "bad handshake" error is returned, since requested protocol is not supported.
 	require.Error(t, err)
-	assert.True(t, strings.Contains(err.Error(), "bad handshake"))
+	assert.True(t, strings.Contains(err.Error(), "websocket: bad handshake"))
+	assert.True(t, strings.Contains(err.Error(), "403 Forbidden"))
 	assert.True(t, httpstream.IsUpgradeFailure(err))
 }