diff --git a/profiles/internal/rt/runtime.go b/profiles/internal/rt/runtime.go
index bc9c3af..320a1b2 100644
--- a/profiles/internal/rt/runtime.go
+++ b/profiles/internal/rt/runtime.go
@@ -145,11 +145,11 @@
 	}
 
 	// Create and set the principal
-	principal, deps, err := r.initPrincipal(ctx, flags.Credentials)
+	principal, deps, shutdown, err := r.initPrincipal(ctx, flags.Credentials)
 	if err != nil {
 		return nil, nil, nil, err
 	}
-	ctx, err = r.setPrincipal(ctx, principal, deps...)
+	ctx, err = r.setPrincipal(ctx, principal, shutdown, deps...)
 	if err != nil {
 		return nil, nil, nil, err
 	}
@@ -308,7 +308,7 @@
 	return newctx, nil
 }
 
-func (r *Runtime) setPrincipal(ctx *context.T, principal security.Principal, deps ...interface{}) (*context.T, error) {
+func (r *Runtime) setPrincipal(ctx *context.T, principal security.Principal, shutdown func(), deps ...interface{}) (*context.T, error) {
 	if principal != nil {
 		// We uniquely identify a principal with "security/principal/<publicKey>"
 		principalName := "security/principal/" + principal.PublicKey().String()
@@ -316,7 +316,7 @@
 		stats.NewStringFunc(principalName+"/blessingroots", principal.Roots().DebugString)
 	}
 	ctx = context.WithValue(ctx, principalKey, principal)
-	return ctx, r.addChild(ctx, principal, func() {}, deps...)
+	return ctx, r.addChild(ctx, principal, shutdown, deps...)
 }
 
 func (r *Runtime) WithPrincipal(ctx *context.T, principal security.Principal) (*context.T, error) {
@@ -328,7 +328,7 @@
 	// For example if they create an agent principal with some client, we don't know
 	// about that, so servers based of this new principal will not prevent the client
 	// from terminating early.
-	if newctx, err = r.setPrincipal(ctx, principal); err != nil {
+	if newctx, err = r.setPrincipal(ctx, principal, func() {}); err != nil {
 		return ctx, err
 	}
 	if newctx, err = r.setNewStreamManager(newctx); err != nil {
diff --git a/profiles/internal/rt/security.go b/profiles/internal/rt/security.go
index d601968..0488424 100644
--- a/profiles/internal/rt/security.go
+++ b/profiles/internal/rt/security.go
@@ -23,9 +23,9 @@
 	"v.io/x/ref/services/agent/agentlib"
 )
 
-func (r *Runtime) initPrincipal(ctx *context.T, credentials string) (principal security.Principal, deps []interface{}, err error) {
+func (r *Runtime) initPrincipal(ctx *context.T, credentials string) (principal security.Principal, deps []interface{}, shutdown func(), err error) {
 	if principal, _ = ctx.Value(principalKey).(security.Principal); principal != nil {
-		return principal, nil, nil
+		return principal, nil, func() {}, nil
 	}
 	if len(credentials) > 0 {
 		// Explicitly specified credentials, ignore the agent.
@@ -39,17 +39,17 @@
 		if principal, err = vsecurity.LoadPersistentPrincipal(credentials, nil); err != nil {
 			if os.IsNotExist(err) {
 				if principal, err = vsecurity.CreatePersistentPrincipal(credentials, nil); err != nil {
-					return principal, nil, err
+					return principal, nil, nil, err
 				}
-				return principal, nil, vsecurity.InitDefaultBlessings(principal, defaultBlessingName())
+				return principal, nil, func() {}, vsecurity.InitDefaultBlessings(principal, defaultBlessingName())
 			}
-			return nil, nil, err
+			return nil, nil, nil, err
 		}
-		return principal, nil, nil
+		return principal, nil, func() {}, nil
 	}
 	// Use credentials stored in the agent.
 	if ep, _, err := agentEP(); err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	} else if ep != nil {
 		// Use a new stream manager and an "incomplete" client (the
 		// principal is nil) to talk to the agent.
@@ -63,26 +63,27 @@
 		// from management of any other connections created in the
 		// process (such as future RPCs to other services).
 		if ctx, err = r.WithNewStreamManager(ctx); err != nil {
-			return nil, nil, err
+			return nil, nil, nil, err
 		}
 		client := r.GetClient(ctx)
 
 		// We reparent the context we use to construct the agent.
 		// We do this because the agent needs to be able to make RPCs
 		// during runtime shutdown.
-		ctx, _ = context.WithRootCancel(ctx)
+		ctx, shutdown = context.WithRootCancel(ctx)
 
 		if principal, err = agentlib.NewAgentPrincipal(ctx, ep, client); err != nil {
+			shutdown()
 			client.Close()
-			return nil, nil, err
+			return nil, nil, nil, err
 		}
-		return principal, []interface{}{client}, nil
+		return principal, []interface{}{client}, shutdown, nil
 	}
 	// No agent, no explicit credentials specified: - create a new principal and blessing in memory.
 	if principal, err = vsecurity.NewPrincipal(); err != nil {
-		return principal, nil, err
+		return principal, nil, nil, err
 	}
-	return principal, nil, vsecurity.InitDefaultBlessings(principal, defaultBlessingName())
+	return principal, nil, func() {}, vsecurity.InitDefaultBlessings(principal, defaultBlessingName())
 }
 
 func parseAgentFD(ep naming.Endpoint) (int, error) {
diff --git a/services/agent/internal/cache/cache.go b/services/agent/internal/cache/cache.go
index e0e7026..cc6b904 100644
--- a/services/agent/internal/cache/cache.go
+++ b/services/agent/internal/cache/cache.go
@@ -375,15 +375,13 @@
 	if err != nil {
 		return
 	}
+
 	go func() {
 		var x bool
 		for {
 			if recvErr := call.Recv(&x); recvErr != nil {
 				if ctx.Err() != context.Canceled {
-					// TODO(mattr): For now I'm commenting this out since the context
-					// doesn't get cancelled before the client is closed.
-					// Revisit this.
-					vlog.VI(2).Infof("Error from agent: %v", recvErr)
+					vlog.Errorf("Error from agent: %v", recvErr)
 				}
 				flush()
 				call.Finish()