diff --git a/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts b/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts
index 1b6e275b7..feb473c1f 100644
--- a/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts
+++ b/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts
@@ -82,23 +82,32 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
     const url = new URL(providerInputs.url);
     const k8sPort = url.port ? Number(url.port) : 443;
 
-    if (providerInputs.gatewayId) {
-      const k8sHost = url.hostname;
+    try {
+      if (providerInputs.gatewayId) {
+        const k8sHost = url.hostname;
 
-      await $gatewayProxyWrapper(
-        {
-          gatewayId: providerInputs.gatewayId,
-          targetHost: k8sHost,
-          targetPort: k8sPort
-        },
-        serviceAccountGetCallback
-      );
-    } else {
-      const k8sHost = `${url.protocol}//${url.hostname}`;
-      await serviceAccountGetCallback(k8sHost, k8sPort);
+        await $gatewayProxyWrapper(
+          {
+            gatewayId: providerInputs.gatewayId,
+            targetHost: k8sHost,
+            targetPort: k8sPort
+          },
+          serviceAccountGetCallback
+        );
+      } else {
+        const k8sHost = `${url.protocol}//${url.hostname}`;
+        await serviceAccountGetCallback(k8sHost, k8sPort);
+      }
+
+      return true;
+    } catch (error) {
+      let errorMessage = error instanceof Error ? error.message : "Unknown error";
+      if (axios.isAxiosError(error) && (error.response?.data as { message: string })?.message) {
+        errorMessage = (error.response?.data as { message: string }).message;
+      }
+
+      throw new Error(`Failed to validate connection: ${errorMessage}`);
     }
-
-    return true;
   };
 
   const create = async (inputs: unknown, expireAt: number) => {
@@ -137,21 +146,30 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
     const k8sGatewayHost = url.hostname;
     const k8sPort = url.port ? Number(url.port) : 443;
 
-    const tokenData = providerInputs.gatewayId
-      ? await $gatewayProxyWrapper(
-          {
-            gatewayId: providerInputs.gatewayId,
-            targetHost: k8sGatewayHost,
-            targetPort: k8sPort
-          },
-          tokenRequestCallback
-        )
-      : await tokenRequestCallback(k8sHost, k8sPort);
+    try {
+      const tokenData = providerInputs.gatewayId
+        ? await $gatewayProxyWrapper(
+            {
+              gatewayId: providerInputs.gatewayId,
+              targetHost: k8sGatewayHost,
+              targetPort: k8sPort
+            },
+            tokenRequestCallback
+          )
+        : await tokenRequestCallback(k8sHost, k8sPort);
 
-    return {
-      entityId: providerInputs.serviceAccountName,
-      data: { TOKEN: tokenData.status.token }
-    };
+      return {
+        entityId: providerInputs.serviceAccountName,
+        data: { TOKEN: tokenData.status.token }
+      };
+    } catch (error) {
+      let errorMessage = error instanceof Error ? error.message : "Unknown error";
+      if (axios.isAxiosError(error) && (error.response?.data as { message: string })?.message) {
+        errorMessage = (error.response?.data as { message: string }).message;
+      }
+
+      throw new Error(`Failed to validate connection: ${errorMessage}`);
+    }
   };
 
   const revoke = async (_inputs: unknown, entityId: string) => {
diff --git a/backend/src/lib/gateway/index.ts b/backend/src/lib/gateway/index.ts
index 7a94c6384..c1a8b48c6 100644
--- a/backend/src/lib/gateway/index.ts
+++ b/backend/src/lib/gateway/index.ts
@@ -3,6 +3,7 @@ import crypto from "node:crypto";
 import net from "node:net";
 
 import quicDefault, * as quicModule from "@infisical/quic";
+import axios from "axios";
 
 import { BadRequestError } from "../errors";
 import { logger } from "../logger";
@@ -378,7 +379,12 @@ export const withGatewayProxy = async <T>(
       logger.error(new Error(proxyErrorMessage), "Failed to proxy");
     }
     logger.error(err, "Failed to do gateway");
-    throw new BadRequestError({ message: proxyErrorMessage || (err as Error)?.message });
+    let errorMessage = proxyErrorMessage || (err as Error)?.message;
+    if (axios.isAxiosError(err) && (err.response?.data as { message?: string })?.message) {
+      errorMessage = (err.response?.data as { message: string }).message;
+    }
+
+    throw new BadRequestError({ message: errorMessage });
   } finally {
     // Ensure cleanup happens regardless of success or failure
     await cleanup();