diff --git a/internal/openbao/bootstrap.go b/internal/openbao/bootstrap.go
index d3ab2e7..d177608 100644
--- a/internal/openbao/bootstrap.go
+++ b/internal/openbao/bootstrap.go
@@ -268,18 +268,29 @@ func writeSecret(kubeconfig, rootToken, secretPath string, values map[string]str
 
 func waitForPod(kubeconfig string) error {
 	deadline := time.Now().Add(10 * time.Minute)
+	var lastErr error
 	for time.Now().Before(deadline) {
 		if _, err := getStatus(kubeconfig); err == nil {
 			return nil
+		} else {
+			lastErr = err
 		}
 		time.Sleep(2 * time.Second)
 	}
+	if lastErr != nil {
+		return fmt.Errorf("OpenBao pod did not become ready: %w", lastErr)
+	}
 	return fmt.Errorf("OpenBao pod did not become ready")
 }
 
 func getStatus(kubeconfig string) (status, error) {
 	command := []string{"--kubeconfig", kubeconfig, "-n", "openbao", "exec", "openbao-0", "--", "bao", "status", "-format=json"}
-	output, err := commandOutput(nil, "kubectl", command...)
+	ctx, cancel := context.WithTimeout(context.Background(), commandTimeout)
+	defer cancel()
+	output, err := exec.CommandContext(ctx, "kubectl", command...).Output()
+	if errors.Is(ctx.Err(), context.DeadlineExceeded) {
+		return status{}, fmt.Errorf("get OpenBao status timed out after %s", commandTimeout)
+	}
 	if err != nil && !json.Valid(output) {
 		return status{}, fmt.Errorf("get OpenBao status: %w", err)
 	}
@@ -333,7 +344,7 @@ read -r reviewer_token
 export BAO_TOKEN="$root_token"
 bao secrets enable -path=secret kv-v2 >/dev/null 2>&1 || true
 bao auth enable kubernetes >/dev/null 2>&1 || true
-bao write auth/kubernetes/config token_reviewer_jwt="$reviewer_token" kubernetes_host="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}" kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt >/dev/null 2>&1 || fail kubernetes-auth-config
+bao write auth/kubernetes/config token_reviewer_jwt="$reviewer_token" kubernetes_host="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}" kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt >/dev/null || fail kubernetes-auth-config
 cat >/tmp/external-secrets.hcl <<'EOF'
 	path "secret/data/platform/*" {
 	  capabilities = ["read"]