diff --git a/staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/exec.go b/staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/exec.go
index 652e59a2db4..f1441d82f49 100644
--- a/staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/exec.go
+++ b/staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/exec.go
@@ -18,6 +18,7 @@ package exec
 
 import (
 	"bytes"
+	"context"
 	"crypto/tls"
 	"crypto/x509"
 	"errors"
@@ -206,7 +207,10 @@ func newAuthenticator(c *cache, isTerminalFunc func(int) bool, config *api.ExecC
 
 	// these functions are made comparable and stored in the cache so that repeated clientset
 	// construction with the same rest.Config results in a single TLS cache and Authenticator
-	a.getCert = &transport.GetCertHolder{GetCert: a.cert}
+	a.getCert = &transport.GetCertHolder{GetCert: func() (*tls.Certificate, error) {
+		// TODO (?): change or extend the c.TLS.GetCertHolder API
+		return a.cert(context.TODO())
+	}}
 	a.dial = &transport.DialHolder{Dial: defaultDialer.DialContext}
 
 	return c.put(key, a), nil
@@ -343,7 +347,7 @@ func (r *roundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
 	}
 
 	ctx := req.Context()
-	creds, err := r.a.getCreds()
+	creds, err := r.a.getCreds(ctx)
 	if err != nil {
 		return nil, fmt.Errorf("getting credentials: %v", err)
 	}
@@ -356,7 +360,7 @@ func (r *roundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
 		return nil, err
 	}
 	if res.StatusCode == http.StatusUnauthorized {
-		if err := r.a.maybeRefreshCreds(creds); err != nil {
+		if err := r.a.maybeRefreshCreds(ctx, creds); err != nil {
 			klog.FromContext(ctx).Error(err, "Refreshing credentials failed")
 		}
 	}
@@ -370,15 +374,15 @@ func (a *Authenticator) credsExpired() bool {
 	return a.now().After(a.exp)
 }
 
-func (a *Authenticator) cert() (*tls.Certificate, error) {
-	creds, err := a.getCreds()
+func (a *Authenticator) cert(ctx context.Context) (*tls.Certificate, error) {
+	creds, err := a.getCreds(ctx)
 	if err != nil {
 		return nil, err
 	}
 	return creds.cert, nil
 }
 
-func (a *Authenticator) getCreds() (*credentials, error) {
+func (a *Authenticator) getCreds(ctx context.Context) (*credentials, error) {
 	a.mu.Lock()
 	defer a.mu.Unlock()
 
@@ -386,7 +390,7 @@ func (a *Authenticator) getCreds() (*credentials, error) {
 		return a.cachedCreds, nil
 	}
 
-	if err := a.refreshCredsLocked(); err != nil {
+	if err := a.refreshCredsLocked(ctx); err != nil {
 		return nil, err
 	}
 
@@ -395,7 +399,7 @@ func (a *Authenticator) getCreds() (*credentials, error) {
 
 // maybeRefreshCreds executes the plugin to force a rotation of the
 // credentials, unless they were rotated already.
-func (a *Authenticator) maybeRefreshCreds(creds *credentials) error {
+func (a *Authenticator) maybeRefreshCreds(ctx context.Context, creds *credentials) error {
 	a.mu.Lock()
 	defer a.mu.Unlock()
 
@@ -406,12 +410,12 @@ func (a *Authenticator) maybeRefreshCreds(creds *credentials) error {
 		return nil
 	}
 
-	return a.refreshCredsLocked()
+	return a.refreshCredsLocked(ctx)
 }
 
 // refreshCredsLocked executes the plugin and reads the credentials from
 // stdout. It must be called while holding the Authenticator's mutex.
-func (a *Authenticator) refreshCredsLocked() error {
+func (a *Authenticator) refreshCredsLocked(ctx context.Context) error {
 	interactive, err := a.interactiveFunc()
 	if err != nil {
 		return fmt.Errorf("exec plugin cannot support interactive mode: %w", err)
@@ -443,7 +447,7 @@ func (a *Authenticator) refreshCredsLocked() error {
 	}
 
 	err = cmd.Run()
-	incrementCallsMetric(err)
+	incrementCallsMetric(ctx, err)
 	if err != nil {
 		return a.wrapCmdRunErrorLocked(err)
 	}
diff --git a/staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/exec_test.go b/staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/exec_test.go
index 291590eca86..606037b9496 100644
--- a/staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/exec_test.go
+++ b/staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/exec_test.go
@@ -42,6 +42,7 @@ import (
 	"k8s.io/client-go/pkg/apis/clientauthentication"
 	"k8s.io/client-go/tools/clientcmd/api"
 	"k8s.io/client-go/transport"
+	"k8s.io/klog/v2/ktesting"
 	testingclock "k8s.io/utils/clock/testing"
 )
 
@@ -790,6 +791,7 @@ func TestRefreshCreds(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
+			_, ctx := ktesting.NewTestContext(t)
 			c := test.config
 
 			if c.Command == "" {
@@ -813,7 +815,7 @@ func TestRefreshCreds(t *testing.T) {
 			a.stderr = stderr
 			a.environ = func() []string { return nil }
 
-			if err := a.refreshCredsLocked(); err != nil {
+			if err := a.refreshCredsLocked(ctx); err != nil {
 				if !test.wantErr {
 					t.Errorf("get token %v", err)
 				} else if !strings.Contains(err.Error(), test.wantErrSubstr) {
@@ -1190,6 +1192,7 @@ func TestInstallHintRateLimit(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
+			_, ctx := ktesting.NewTestContext(t)
 			c := api.ExecConfig{
 				Command:         "does not exist",
 				APIVersion:      "client.authentication.k8s.io/v1beta1",
@@ -1209,7 +1212,7 @@ func TestInstallHintRateLimit(t *testing.T) {
 
 			count := 0
 			for i := 0; i < test.calls; i++ {
-				err := a.refreshCredsLocked()
+				err := a.refreshCredsLocked(ctx)
 				if strings.Contains(err.Error(), c.InstallHint) {
 					count++
 				}
diff --git a/staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/metrics.go b/staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/metrics.go
index d25122f360a..cad7750b098 100644
--- a/staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/metrics.go
+++ b/staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/metrics.go
@@ -17,6 +17,7 @@ limitations under the License.
 package exec
 
 import (
+	"context"
 	"errors"
 	"io/fs"
 	"os/exec"
@@ -90,7 +91,7 @@ func (c *certificateExpirationTracker) set(a *Authenticator, t time.Time) {
 // incrementCallsMetric increments a global metrics counter for the number of calls to an exec
 // plugin, partitioned by exit code. The provided err should be the return value from
 // exec.Cmd.Run().
-func incrementCallsMetric(err error) {
+func incrementCallsMetric(ctx context.Context, err error) {
 	execExitError := &exec.ExitError{}
 	execError := &exec.Error{}
 	pathError := &fs.PathError{}
@@ -105,8 +106,7 @@ func incrementCallsMetric(err error) {
 		metrics.ExecPluginCalls.Increment(failureExitCode, pluginNotFoundError)
 
 	default: // We don't know about this error type.
-		//nolint:logcheck // This looks like debug output which shouldn't occur in practice.
-		klog.V(2).InfoS("unexpected exec plugin return error type", "type", reflect.TypeOf(err).String(), "err", err)
+		klog.FromContext(ctx).V(2).Info("unexpected exec plugin return error type", "type", reflect.TypeOf(err).String(), "err", err)
 		metrics.ExecPluginCalls.Increment(failureExitCode, clientInternalError)
 	}
 }
diff --git a/staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/metrics_test.go b/staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/metrics_test.go
index 61360abdb7c..43219795839 100644
--- a/staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/metrics_test.go
+++ b/staging/src/k8s.io/client-go/plugin/pkg/client/auth/exec/metrics_test.go
@@ -25,6 +25,7 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"k8s.io/client-go/tools/clientcmd/api"
 	"k8s.io/client-go/tools/metrics"
+	"k8s.io/klog/v2/ktesting"
 )
 
 type mockExpiryGauge struct {
@@ -115,6 +116,7 @@ func (f *mockCallsMetricCounter) Increment(exitCode int, errorType string) {
 }
 
 func TestCallsMetric(t *testing.T) {
+	_, ctx := ktesting.NewTestContext(t)
 	const (
 		goodOutput = `{
 			"kind": "ExecCredential",
@@ -152,7 +154,7 @@ func TestCallsMetric(t *testing.T) {
 		// Run refresh creds twice so that our test validates that the metrics are set correctly twice
 		// in a row with the same authenticator.
 		refreshCreds := func() {
-			if err := a.refreshCredsLocked(); (err == nil) != (exitCode == 0) {
+			if err := a.refreshCredsLocked(ctx); (err == nil) != (exitCode == 0) {
 				if err != nil {
 					t.Fatalf("wanted no error, but got %q", err.Error())
 				} else {
@@ -182,7 +184,7 @@ func TestCallsMetric(t *testing.T) {
 			t.Fatal(err)
 		}
 		a.stderr = io.Discard
-		if err := a.refreshCredsLocked(); err == nil {
+		if err := a.refreshCredsLocked(ctx); err == nil {
 			t.Fatal("expected the authenticator to fail because the plugin does not exist")
 		}
 		wantCallsMetrics = append(wantCallsMetrics, mockCallsMetric{exitCode: 1, errorType: "plugin_not_found_error"})