diff --git a/Sources/GoogleCloudBase/GCPClient.swift b/Sources/GoogleCloudBase/GCPClient.swift
index fb9afe8..811d67d 100644
--- a/Sources/GoogleCloudBase/GCPClient.swift
+++ b/Sources/GoogleCloudBase/GCPClient.swift
@@ -99,9 +99,16 @@ public struct GCPClient: Sendable {
         (httpClient, httpClientCompressionEnabled) = httpClientProvider.build(logger: clientLogger)
         self.clientLogger = clientLogger
         self.options = options
-        self.credential = try await credentialFactory.makeCredential(
-            context: .init(httpClient: httpClient, logger: clientLogger)
-        )
+        do {
+            self.credential = try await credentialFactory.makeCredential(
+                context: .init(httpClient: httpClient, logger: clientLogger)
+            )
+        } catch {
+            Task { [httpClient, httpClientProvider] in
+                try await Self.shutdownHTTPClient(client: httpClient, provider: httpClientProvider)
+            }
+            throw error
+        }
     }
 
     @available(*, noasync, message: "syncShutdown() can block indefinitely, prefer shutdown()", renamed: "shutdown()")
diff --git a/Tests/SharedTests/Core/GCPClientTest.swift b/Tests/SharedTests/Core/GCPClientTest.swift
index 3c97e5e..212b11e 100644
--- a/Tests/SharedTests/Core/GCPClientTest.swift
+++ b/Tests/SharedTests/Core/GCPClientTest.swift
@@ -1,4 +1,27 @@
 import GoogleCloudBase
+import Testing
+
+@Suite struct GCPClientTest {
+    enum MyError: Error {
+        case failure
+    }
+
+    @Test func makeCredentialFailed() async {
+        // sync
+        #expect(throws: MyError.self) {
+            _ = try GCPClient(credentialFactory: SyncCredentialFactory.custom { _ in
+                throw MyError.failure
+            })
+        }
+
+        // async
+        await #expect(throws: MyError.self) {
+            _ = try await GCPClient(credentialFactory: AsyncCredentialFactory.custom { _ in
+                throw MyError.failure
+            })
+        }
+    }
+}
 
 func gcpClientOverload() throws {
     _ = try GCPClient(credentialFactory: .selector(.environment, .configFile))