diff --git a/internal/servers/repository_workerauth.go b/internal/servers/repository_workerauth.go
index d266e16b5..95d22465d 100644
--- a/internal/servers/repository_workerauth.go
+++ b/internal/servers/repository_workerauth.go
@@ -248,8 +248,13 @@ func (r *WorkerAuthRepositoryStorage) storeRootCertificates(ctx context.Context,
 	}
 
 	nextCert, err := r.convertRootCertificate(ctx, cert.Next)
+	if err != nil {
+		return errors.Wrap(ctx, err, op, errors.WithMsg("unable to convert next root certificate"))
+	}
 	currentCert, err := r.convertRootCertificate(ctx, cert.Current)
-
+	if err != nil {
+		return errors.Wrap(ctx, err, op, errors.WithMsg("unable to convert current root certificate"))
+	}
 	// Use passed version
 	var result rootCertificatesVersion
 	err = mapstructure.Decode(cert.State.AsMap(), &result)
diff --git a/internal/servers/workerauth_store_test.go b/internal/servers/workerauth_store_test.go
index e66d6d67d..fdbe415d6 100644
--- a/internal/servers/workerauth_store_test.go
+++ b/internal/servers/workerauth_store_test.go
@@ -255,6 +255,7 @@ func TestDuplicateRootCert(t *testing.T) {
 	current2, err := newRootCertificate(ctx, rand.Uint64(), populateBytes(defaultLength), beforeTimestamp, afterTimestamp,
 		RootCertificateKeys{publicKey: populateBytes(defaultLength), privateKey: populateBytes(defaultLength)},
 		testKey, CurrentState)
+	require.NoError(t, err)
 	next1, err := newRootCertificate(ctx, rand.Uint64(), populateBytes(defaultLength), beforeTimestamp, afterTimestamp,
 		RootCertificateKeys{publicKey: populateBytes(defaultLength), privateKey: populateBytes(defaultLength)},
 		testKey, NextState)