diff --git a/pipelines/concourse-workers/pipeline.yml b/pipelines/concourse-workers/pipeline.yml
index e13c61164..4710fb9f7 100644
--- a/pipelines/concourse-workers/pipeline.yml
+++ b/pipelines/concourse-workers/pipeline.yml
@@ -174,6 +174,6 @@ jobs:
         attempts: 2
         timeout: 25m
         file: pinniped-ci/pipelines/shared-tasks/remove-orphaned-aks-clusters/task.yml
-        image: gcloud-image
+        image: aks-deployer-image
         params:
           <<: *azure_account_params
diff --git a/pipelines/shared-tasks/remove-orphaned-aks-clusters/task.sh b/pipelines/shared-tasks/remove-orphaned-aks-clusters/task.sh
index e1828f4d0..91dc991f9 100755
--- a/pipelines/shared-tasks/remove-orphaned-aks-clusters/task.sh
+++ b/pipelines/shared-tasks/remove-orphaned-aks-clusters/task.sh
@@ -29,6 +29,11 @@ az rest \
   --url "https://management.azure.com/subscriptions/${AZURE_SUBSCRIPTION_ID}/resources" \
   --url-parameters api-version=2024-08-01 \$expand=createdTime >all-resources.json
 
+if [[ $(jq '.value | length' all-resources.json) == "0" ]]; then
+  echo "No resources were found in the subscription. Does the service account have permissions to list all resources?"
+  exit 1
+fi
+
 # Filter resources by clusters in the expected resource group.
 # Write another file where each line is a cluster name, followed by a space, followed by its creation time.
 cat all-resources.json |