diff --git a/internal/localuserauthenticator/localuserauthenticator.go b/internal/localuserauthenticator/localuserauthenticator.go
index b5dd58c35..c648e9fa2 100644
--- a/internal/localuserauthenticator/localuserauthenticator.go
+++ b/internal/localuserauthenticator/localuserauthenticator.go
@@ -358,7 +358,7 @@ func run(ctx context.Context) error {
 	plog.Debug("controllers are ready")
 
 	listenConfig := net.ListenConfig{}
-	l, err := listenConfig.Listen(context.Background(), "tcp", ":8443")
+	l, err := listenConfig.Listen(ctx, "tcp", ":8443")
 	if err != nil {
 		return fmt.Errorf("cannot create listener: %w", err)
 	}
diff --git a/test/integration/concierge_tls_spec_test.go b/test/integration/concierge_tls_spec_test.go
index 77df56bb3..e6eb005a9 100644
--- a/test/integration/concierge_tls_spec_test.go
+++ b/test/integration/concierge_tls_spec_test.go
@@ -1,4 +1,4 @@
-// Copyright 2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2024-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 package integration
 
@@ -701,7 +701,9 @@ func performKubectlApply(t *testing.T, resourceName string, yamlBytes []byte) (s
 
 	t.Cleanup(func() {
 		t.Helper()
-		require.NoError(t, exec.CommandContext(t.Context(), "kubectl", "delete", "--ignore-not-found", "-f", yamlFilepath).Run())
+		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+		defer cancel()
+		require.NoError(t, exec.CommandContext(ctx, "kubectl", "delete", "--ignore-not-found", "-f", yamlFilepath).Run())
 	})
 
 	return stdOut.String(), stdErr.String(), err