diff --git a/internal/credential/vault/credential_store.go b/internal/credential/vault/credential_store.go
index a796ee5ce..52592e20e 100644
--- a/internal/credential/vault/credential_store.go
+++ b/internal/credential/vault/credential_store.go
@@ -1,6 +1,7 @@
 package vault
 
 import (
+	"context"
 	"strings"
 
 	"github.com/hashicorp/boundary/internal/credential/vault/store"
@@ -168,7 +169,7 @@ func (cs *CredentialStore) ClientCertificate() *ClientCertificate {
 	return cs.clientCert
 }
 
-func (cs *CredentialStore) client() (*client, error) {
+func (cs *CredentialStore) client(ctx context.Context) (*client, error) {
 	const op = "vault.(CredentialStore).client"
 	clientConfig := &clientConfig{
 		Addr:          cs.VaultAddress,
@@ -183,9 +184,9 @@ func (cs *CredentialStore) client() (*client, error) {
 		clientConfig.ClientKey = cs.clientCert.GetCertificateKey()
 	}
 
-	c, err := newClient(clientConfig)
+	c, err := newClient(ctx, clientConfig)
 	if err != nil {
-		return nil, errors.WrapDeprecated(err, op)
+		return nil, errors.Wrap(ctx, err, op)
 	}
 	return c, nil
 }
diff --git a/internal/credential/vault/jobs.go b/internal/credential/vault/jobs.go
index 0ff5c79fc..384e22f8b 100644
--- a/internal/credential/vault/jobs.go
+++ b/internal/credential/vault/jobs.go
@@ -181,13 +181,13 @@ func (r *TokenRenewalJob) renewToken(ctx context.Context, s *privateStore) error
 		return nil
 	}
 
-	vc, err := s.client()
+	vc, err := s.client(ctx)
 	if err != nil {
 		return errors.Wrap(ctx, err, op)
 	}
 
 	var respErr *vault.ResponseError
-	renewedToken, err := vc.renewToken()
+	renewedToken, err := vc.renewToken(ctx)
 	if ok := errors.As(err, &respErr); ok && respErr.StatusCode == http.StatusForbidden {
 		// Vault returned a 403 when attempting a renew self, the token is either expired
 		// or malformed.  Set status to "expired" so credentials created with token can be
@@ -411,13 +411,13 @@ func (r *TokenRevocationJob) revokeToken(ctx context.Context, s *privateStore) e
 		return nil
 	}
 
-	vc, err := s.client()
+	vc, err := s.client(ctx)
 	if err != nil {
 		return errors.Wrap(ctx, err, op)
 	}
 
 	var respErr *vault.ResponseError
-	err = vc.revokeToken()
+	err = vc.revokeToken(ctx)
 	if ok := errors.As(err, &respErr); ok && respErr.StatusCode == http.StatusForbidden {
 		// Vault returned a 403 when attempting a revoke self, the token is already expired.
 		// Clobber error and set status to "revoked" below.
@@ -561,7 +561,7 @@ func (r *CredentialRenewalJob) renewCred(ctx context.Context, c *privateCredenti
 		return errors.Wrap(ctx, err, op)
 	}
 
-	vc, err := c.client()
+	vc, err := c.client(ctx)
 	if err != nil {
 		return errors.Wrap(ctx, err, op)
 	}
@@ -570,7 +570,7 @@ func (r *CredentialRenewalJob) renewCred(ctx context.Context, c *privateCredenti
 	var respErr *vault.ResponseError
 	// Subtract last renewal time from previous expiration time to get lease duration
 	leaseDuration := c.ExpirationTime.AsTime().Sub(c.LastRenewalTime.AsTime())
-	renewedCred, err := vc.renewLease(c.ExternalId, leaseDuration)
+	renewedCred, err := vc.renewLease(ctx, c.ExternalId, leaseDuration)
 	if ok := errors.As(err, &respErr); ok && respErr.StatusCode == http.StatusBadRequest {
 		// Vault returned a 400 when attempting a renew lease, the lease is either expired
 		// or the leaseId is malformed.  Set status to "expired".
@@ -720,14 +720,14 @@ func (r *CredentialRevocationJob) revokeCred(ctx context.Context, c *privateCred
 		return errors.Wrap(ctx, err, op)
 	}
 
-	vc, err := c.client()
+	vc, err := c.client(ctx)
 	if err != nil {
 		return errors.Wrap(ctx, err, op)
 	}
 
 	cred := c.toCredential()
 	var respErr *vault.ResponseError
-	err = vc.revokeLease(c.ExternalId)
+	err = vc.revokeLease(ctx, c.ExternalId)
 	if ok := errors.As(err, &respErr); ok && respErr.StatusCode == http.StatusBadRequest {
 		// Vault returned a 400 when attempting a revoke lease, the lease is already expired.
 		// Clobber error and set status to "revoked" below.
diff --git a/internal/credential/vault/jobs_test.go b/internal/credential/vault/jobs_test.go
index d850a23c3..d4af1d315 100644
--- a/internal/credential/vault/jobs_test.go
+++ b/internal/credential/vault/jobs_test.go
@@ -97,6 +97,7 @@ func testVaultCred(t *testing.T,
 	expiration time.Duration,
 ) (*vault.Secret, *Credential) {
 	t.Helper()
+	ctx := context.Background()
 	assert, require := assert.New(t), require.New(t)
 	rw := db.New(conn)
 
@@ -105,9 +106,9 @@ func testVaultCred(t *testing.T,
 	var err error
 	switch Method(cl.HttpMethod) {
 	case MethodGet:
-		secret, err = client.get(cl.VaultPath)
+		secret, err = client.get(ctx, cl.VaultPath)
 	case MethodPost:
-		secret, err = client.post(cl.VaultPath, cl.HttpRequestBody)
+		secret, err = client.post(ctx, cl.VaultPath, cl.HttpRequestBody)
 	}
 	require.NoError(err)
 	require.NotNil(secret)
diff --git a/internal/credential/vault/private_credential.go b/internal/credential/vault/private_credential.go
index 657669bdd..be01e7402 100644
--- a/internal/credential/vault/private_credential.go
+++ b/internal/credential/vault/private_credential.go
@@ -79,7 +79,7 @@ func (pc *privateCredential) decrypt(ctx context.Context, cipher wrapping.Wrappe
 	return nil
 }
 
-func (pc *privateCredential) client() (*client, error) {
+func (pc *privateCredential) client(ctx context.Context) (*client, error) {
 	const op = "vault.(privateCredential).client"
 	clientConfig := &clientConfig{
 		Addr:          pc.VaultAddress,
@@ -95,7 +95,7 @@ func (pc *privateCredential) client() (*client, error) {
 		clientConfig.ClientKey = pc.ClientKey
 	}
 
-	client, err := newClient(clientConfig)
+	client, err := newClient(ctx, clientConfig)
 	if err != nil {
 		return nil, errors.WrapDeprecated(err, op, errors.WithMsg("unable to create vault client"))
 	}
diff --git a/internal/credential/vault/private_library.go b/internal/credential/vault/private_library.go
index 8531e4a69..6b9840f7c 100644
--- a/internal/credential/vault/private_library.go
+++ b/internal/credential/vault/private_library.go
@@ -257,7 +257,7 @@ func (pl *privateLibrary) decrypt(ctx context.Context, cipher wrapping.Wrapper)
 	return nil
 }
 
-func (pl *privateLibrary) client() (*client, error) {
+func (pl *privateLibrary) client(ctx context.Context) (*client, error) {
 	const op = "vault.(privateLibrary).client"
 	clientConfig := &clientConfig{
 		Addr:          pl.VaultAddress,
@@ -273,7 +273,7 @@ func (pl *privateLibrary) client() (*client, error) {
 		clientConfig.ClientKey = pl.ClientKey
 	}
 
-	client, err := newClient(clientConfig)
+	client, err := newClient(ctx, clientConfig)
 	if err != nil {
 		return nil, errors.WrapDeprecated(err, op, errors.WithMsg("unable to create vault client"))
 	}
@@ -297,7 +297,7 @@ func (pl *privateLibrary) retrieveCredential(ctx context.Context, op errors.Op,
 		return nil, errors.Wrap(ctx, err, op)
 	}
 
-	client, err := pl.client()
+	client, err := pl.client(ctx)
 	if err != nil {
 		return nil, errors.Wrap(ctx, err, op)
 	}
@@ -305,9 +305,9 @@ func (pl *privateLibrary) retrieveCredential(ctx context.Context, op errors.Op,
 	var secret *vault.Secret
 	switch Method(pl.HttpMethod) {
 	case MethodGet:
-		secret, err = client.get(pl.VaultPath)
+		secret, err = client.get(ctx, pl.VaultPath)
 	case MethodPost:
-		secret, err = client.post(pl.VaultPath, pl.HttpRequestBody)
+		secret, err = client.post(ctx, pl.VaultPath, pl.HttpRequestBody)
 	default:
 		return nil, errors.New(ctx, errors.Internal, op, fmt.Sprintf("unknown http method: library: %s", pl.PublicId))
 	}
diff --git a/internal/credential/vault/private_store.go b/internal/credential/vault/private_store.go
index 0194b547b..857d776b0 100644
--- a/internal/credential/vault/private_store.go
+++ b/internal/credential/vault/private_store.go
@@ -182,7 +182,7 @@ func (ps *privateStore) decrypt(ctx context.Context, cipher wrapping.Wrapper) er
 	return nil
 }
 
-func (ps *privateStore) client() (*client, error) {
+func (ps *privateStore) client(ctx context.Context) (*client, error) {
 	const op = "vault.(privateStore).client"
 	clientConfig := &clientConfig{
 		Addr:          ps.VaultAddress,
@@ -198,7 +198,7 @@ func (ps *privateStore) client() (*client, error) {
 		clientConfig.ClientKey = ps.ClientKey
 	}
 
-	client, err := newClient(clientConfig)
+	client, err := newClient(ctx, clientConfig)
 	if err != nil {
 		return nil, errors.WrapDeprecated(err, op, errors.WithMsg("unable to create vault client"))
 	}
diff --git a/internal/credential/vault/repository_credential_store.go b/internal/credential/vault/repository_credential_store.go
index f66773544..1b58f058e 100644
--- a/internal/credential/vault/repository_credential_store.go
+++ b/internal/credential/vault/repository_credential_store.go
@@ -74,11 +74,11 @@ func (r *Repository) CreateCredentialStore(ctx context.Context, cs *CredentialSt
 		cs.clientCert.StoreId = id
 	}
 
-	client, err := cs.client()
+	client, err := cs.client(ctx)
 	if err != nil {
 		return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to create vault client"))
 	}
-	tokenLookup, err := client.lookupToken()
+	tokenLookup, err := client.lookupToken(ctx)
 	if err != nil {
 		return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to lookup vault token"))
 	}
@@ -86,7 +86,7 @@ func (r *Repository) CreateCredentialStore(ctx context.Context, cs *CredentialSt
 		return nil, err
 	}
 
-	available, err := client.capabilities(requiredCapabilities.paths())
+	available, err := client.capabilities(ctx, requiredCapabilities.paths())
 	if err != nil {
 		return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get vault capabilities"))
 	}
@@ -96,7 +96,7 @@ func (r *Repository) CreateCredentialStore(ctx context.Context, cs *CredentialSt
 			errors.New(ctx, errors.VaultTokenMissingCapabilities, op, fmt.Sprintf("missing capabilites: %v", missing))
 	}
 
-	renewedToken, err := client.renewToken()
+	renewedToken, err := client.renewToken(ctx)
 	if err != nil {
 		return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to renew vault token"))
 	}
@@ -473,12 +473,12 @@ func (r *Repository) UpdateCredentialStore(ctx context.Context, cs *CredentialSt
 	}
 
 	var token *Token
-	client, err := updatedStore.client()
+	client, err := updatedStore.client(ctx)
 	if err != nil {
 		return nil, db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get client for updated store"))
 	}
 	if validateToken {
-		tokenLookup, err := client.lookupToken()
+		tokenLookup, err := client.lookupToken(ctx)
 		if err != nil {
 			return nil, db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithMsg("cannot lookup token for updated store"))
 		}
@@ -486,7 +486,7 @@ func (r *Repository) UpdateCredentialStore(ctx context.Context, cs *CredentialSt
 			return nil, db.NoRowsAffected, errors.Wrap(ctx, err, op)
 		}
 
-		available, err := client.capabilities(requiredCapabilities.paths())
+		available, err := client.capabilities(ctx, requiredCapabilities.paths())
 		if err != nil {
 			return nil, db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get vault capabilities"))
 		}
@@ -498,7 +498,7 @@ func (r *Repository) UpdateCredentialStore(ctx context.Context, cs *CredentialSt
 		}
 	}
 	if updateToken {
-		renewedToken, err := client.renewToken()
+		renewedToken, err := client.renewToken(ctx)
 		if err != nil {
 			return nil, db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithMsg("unable to renew vault token"))
 		}
diff --git a/internal/credential/vault/testing.go b/internal/credential/vault/testing.go
index 3a17a9a0f..432fe6f70 100644
--- a/internal/credential/vault/testing.go
+++ b/internal/credential/vault/testing.go
@@ -627,6 +627,7 @@ func (v *TestVaultServer) client(t testing.TB) *client {
 
 func (v *TestVaultServer) clientUsingToken(t testing.TB, token string) *client {
 	t.Helper()
+	ctx := context.Background()
 	require := require.New(t)
 	conf := &clientConfig{
 		Addr:       v.Addr,
@@ -636,10 +637,10 @@ func (v *TestVaultServer) clientUsingToken(t testing.TB, token string) *client {
 		ClientKey:  v.ClientKey,
 	}
 
-	client, err := newClient(conf)
+	client, err := newClient(ctx, conf)
 	require.NoError(err)
 	require.NotNil(client)
-	require.NoError(client.ping())
+	require.NoError(client.ping(ctx))
 	return client
 }
 
@@ -823,10 +824,11 @@ func (v *TestVaultServer) AddKVPolicy(t testing.TB, _ ...TestOption) {
 // https://www.vaultproject.io/api-docs/secret/kv/kv-v2#create-update-secret
 func (v *TestVaultServer) CreateKVSecret(t testing.TB, p string, data []byte) *vault.Secret {
 	t.Helper()
+	ctx := context.Background()
 	require := require.New(t)
 
 	vc := v.client(t)
-	cred, err := vc.post(path.Join("secret", "data", p), data)
+	cred, err := vc.post(ctx, path.Join("secret", "data", p), data)
 	require.NoError(err)
 	return cred
 }
diff --git a/internal/credential/vault/testing_test.go b/internal/credential/vault/testing_test.go
index ed244434c..df04cc99d 100644
--- a/internal/credential/vault/testing_test.go
+++ b/internal/credential/vault/testing_test.go
@@ -1,6 +1,7 @@
 package vault
 
 import (
+	"context"
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/rand"
@@ -224,6 +225,7 @@ func TestTestVaultServer_CreateToken(t *testing.T) {
 
 func TestNewVaultServer(t *testing.T) {
 	t.Parallel()
+	ctx := context.Background()
 	t.Run("TestNoTLS", func(t *testing.T) {
 		assert, require := assert.New(t), require.New(t)
 		v := NewTestVaultServer(t, WithTestVaultTLS(TestNoTLS))
@@ -237,10 +239,10 @@ func TestNewVaultServer(t *testing.T) {
 			Token: TokenSecret(v.RootToken),
 		}
 
-		client, err := newClient(conf)
+		client, err := newClient(ctx, conf)
 		require.NoError(err)
 		require.NotNil(client)
-		require.NoError(client.ping())
+		require.NoError(client.ping(ctx))
 	})
 	t.Run("TestServerTLS", func(t *testing.T) {
 		assert, require := assert.New(t), require.New(t)
@@ -257,10 +259,10 @@ func TestNewVaultServer(t *testing.T) {
 			CaCert: v.CaCert,
 		}
 
-		client, err := newClient(conf)
+		client, err := newClient(ctx, conf)
 		require.NoError(err)
 		require.NotNil(client)
-		require.NoError(client.ping())
+		require.NoError(client.ping(ctx))
 	})
 	t.Run("TestClientTLS", func(t *testing.T) {
 		assert, require := assert.New(t), require.New(t)
@@ -281,10 +283,10 @@ func TestNewVaultServer(t *testing.T) {
 			ClientKey:  v.ClientKey,
 		}
 
-		client, err := newClient(conf)
+		client, err := newClient(ctx, conf)
 		require.NoError(err)
 		require.NotNil(client)
-		require.NoError(client.ping())
+		require.NoError(client.ping(ctx))
 	})
 	t.Run("TestClientTLS-with-client-key", func(t *testing.T) {
 		assert, require := assert.New(t), require.New(t)
@@ -313,10 +315,10 @@ func TestNewVaultServer(t *testing.T) {
 			ClientKey:  v.ClientKey,
 		}
 
-		client, err := newClient(conf)
+		client, err := newClient(ctx, conf)
 		require.NoError(err)
 		require.NotNil(client)
-		require.NoError(client.ping())
+		require.NoError(client.ping(ctx))
 	})
 }
 
@@ -457,6 +459,7 @@ func TestTestVaultServer_MountDatabase(t *testing.T) {
 
 func TestTestVaultServer_LookupLease(t *testing.T) {
 	t.Parallel()
+	ctx := context.Background()
 	assert, require := assert.New(t), require.New(t)
 	v := NewTestVaultServer(t, WithDockerNetwork(true))
 	v.MountDatabase(t)
@@ -469,14 +472,14 @@ func TestTestVaultServer_LookupLease(t *testing.T) {
 		Token:      TokenSecret(v.RootToken),
 	}
 
-	client, err := newClient(conf)
+	client, err := newClient(ctx, conf)
 	require.NoError(err)
 	require.NotNil(client)
-	assert.NoError(client.ping())
+	assert.NoError(client.ping(ctx))
 
 	// Create secret
 	credPath := path.Join("database", "creds", "opened")
-	cred, err := client.get(credPath)
+	cred, err := client.get(ctx, credPath)
 	require.NoError(err)
 
 	// Sleep to move ttl
@@ -499,12 +502,13 @@ func TestTestVaultServer_LookupLease(t *testing.T) {
 
 func TestTestVaultServer_VerifyTokenInvalid(t *testing.T) {
 	t.Parallel()
+	ctx := context.Background()
 	require := require.New(t)
 	v := NewTestVaultServer(t, WithDockerNetwork(true))
 
 	_, token := v.CreateToken(t)
 	client := v.clientUsingToken(t, token)
-	err := client.revokeToken()
+	err := client.revokeToken(ctx)
 	require.NoError(err)
 	v.VerifyTokenInvalid(t, token)
 
@@ -546,6 +550,7 @@ func Test_testClientCert(t *testing.T) {
 func TestTestVaultServer_AddKVPolicy(t *testing.T) {
 	t.Run("defaults", func(t *testing.T) {
 		t.Parallel()
+		ctx := context.Background()
 		assert, require := assert.New(t), require.New(t)
 		v := NewTestVaultServer(t)
 
@@ -556,7 +561,7 @@ func TestTestVaultServer_AddKVPolicy(t *testing.T) {
 		require.NotNil(token)
 		client := v.clientUsingToken(t, token)
 
-		_, err := client.get("/secret/data/my-secret")
+		_, err := client.get(ctx, "/secret/data/my-secret")
 		assert.Error(err)
 
 		// An attempt to get my-secret should now fail with a 403
@@ -571,7 +576,7 @@ func TestTestVaultServer_AddKVPolicy(t *testing.T) {
 		require.NotNil(token)
 		client = v.clientUsingToken(t, token)
 
-		_, err = client.get("/secret/data/my-secret")
+		_, err = client.get(ctx, "/secret/data/my-secret")
 		assert.NoError(err)
 	})
 }
diff --git a/internal/credential/vault/vault.go b/internal/credential/vault/vault.go
index b9c6baf5b..ba87aa130 100644
--- a/internal/credential/vault/vault.go
+++ b/internal/credential/vault/vault.go
@@ -44,10 +44,10 @@ type client struct {
 	token TokenSecret
 }
 
-func newClient(c *clientConfig) (*client, error) {
+func newClient(ctx context.Context, c *clientConfig) (*client, error) {
 	const op = "vault.newClient"
 	if !c.isValid() {
-		return nil, errors.NewDeprecated(errors.InvalidParameter, op, "invalid configuration")
+		return nil, errors.New(ctx, errors.InvalidParameter, op, "invalid configuration")
 	}
 	vc := vault.DefaultConfig()
 	vc.Address = c.Addr
@@ -58,14 +58,14 @@ func newClient(c *clientConfig) (*client, error) {
 		tlsConfig := vc.HttpClient.Transport.(*http.Transport).TLSClientConfig
 		tlsConfig.InsecureSkipVerify = c.TlsSkipVerify
 		if err := rootcerts.ConfigureTLS(tlsConfig, rootConfig); err != nil {
-			return nil, errors.WrapDeprecated(err, op)
+			return nil, errors.Wrap(ctx, err, op)
 		}
 	}
 
 	if c.isClientTLS() {
 		clientCert, err := tls.X509KeyPair(c.ClientCert, c.ClientKey)
 		if err != nil {
-			return nil, errors.WrapDeprecated(err, op)
+			return nil, errors.Wrap(ctx, err, op)
 		}
 		tlsConfig := vc.HttpClient.Transport.(*http.Transport).TLSClientConfig
 		tlsConfig.GetClientCertificate = func(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
@@ -75,7 +75,7 @@ func newClient(c *clientConfig) (*client, error) {
 
 	vClient, err := vault.NewClient(vc)
 	if err != nil {
-		return nil, errors.WrapDeprecated(err, op)
+		return nil, errors.Wrap(ctx, err, op)
 	}
 	vClient.SetToken(string(c.Token))
 
@@ -93,16 +93,16 @@ func newClient(c *clientConfig) (*client, error) {
 // response is returned. This endpoint is accessible with the default
 // policy in Vault 1.7.2. See
 // https://www.vaultproject.io/api-docs/system/health#read-health-information.
-func (c *client) ping() error {
+func (c *client) ping(ctx context.Context) error {
 	const op = "vault.(client).ping"
 	h, err := c.cl.Sys().Health()
 	switch {
 	case err != nil:
-		return errors.WrapDeprecated(err, op, errors.WithCode(errors.Unknown), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
+		return errors.Wrap(ctx, err, op, errors.WithCode(errors.Unknown), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
 	case h == nil:
-		return errors.NewDeprecated(errors.Unavailable, op, fmt.Sprintf("no response: vault: %s", c.cl.Address()))
+		return errors.New(ctx, errors.Unavailable, op, fmt.Sprintf("no response: vault: %s", c.cl.Address()))
 	case !h.Initialized || h.Sealed:
-		return errors.NewDeprecated(errors.Unavailable, op, fmt.Sprintf("vault (%s): initialized: %t, sealed: %t ", c.cl.Address(), h.Initialized, h.Sealed))
+		return errors.New(ctx, errors.Unavailable, op, fmt.Sprintf("vault (%s): initialized: %t, sealed: %t ", c.cl.Address(), h.Initialized, h.Sealed))
 	}
 
 	return nil
@@ -112,11 +112,11 @@ func (c *client) ping() error {
 // the vault.Secret response. This endpoint is accessible with the default
 // policy in Vault 1.7.2. See
 // https://www.vaultproject.io/api-docs/auth/token#renew-a-token-self.
-func (c *client) renewToken() (*vault.Secret, error) {
+func (c *client) renewToken(ctx context.Context) (*vault.Secret, error) {
 	const op = "vault.(client).renewToken"
 	t, err := c.cl.Auth().Token().RenewSelf(0)
 	if err != nil {
-		return nil, errors.WrapDeprecated(err, op, errors.WithCode(errors.Unknown), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
+		return nil, errors.Wrap(ctx, err, op, errors.WithCode(errors.Unknown), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
 	}
 	return t, nil
 }
@@ -124,11 +124,11 @@ func (c *client) renewToken() (*vault.Secret, error) {
 // revokeToken calls the /auth/token/revoke-self Vault endpoint. This
 // endpoint is accessible with the default policy in Vault 1.7.2. See
 // https://www.vaultproject.io/api-docs/auth/token#revoke-a-token-self.
-func (c *client) revokeToken() error {
+func (c *client) revokeToken(ctx context.Context) error {
 	const op = "vault.(client).revokeToken"
 	// The `token` parameter is kept for backwards compatibility but is ignored, so use ""
 	if err := c.cl.Auth().Token().RevokeSelf(""); err != nil {
-		return errors.WrapDeprecated(err, op, errors.WithCode(errors.Unknown), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
+		return errors.Wrap(ctx, err, op, errors.WithCode(errors.Unknown), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
 	}
 	return nil
 }
@@ -137,11 +137,11 @@ func (c *client) revokeToken() error {
 // vault.Secret response. This endpoint is accessible with the default
 // policy in Vault 1.7.2. See
 // https://www.vaultproject.io/api-docs/system/leases#renew-lease.
-func (c *client) renewLease(leaseId string, leaseDuration time.Duration) (*vault.Secret, error) {
+func (c *client) renewLease(ctx context.Context, leaseId string, leaseDuration time.Duration) (*vault.Secret, error) {
 	const op = "vault.(client).renewLease"
 	t, err := c.cl.Sys().Renew(leaseId, int(leaseDuration.Round(time.Second).Seconds()))
 	if err != nil {
-		return nil, errors.WrapDeprecated(err, op, errors.WithCode(errors.VaultCredentialRequest), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
+		return nil, errors.Wrap(ctx, err, op, errors.WithCode(errors.VaultCredentialRequest), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
 	}
 	return t, nil
 }
@@ -149,10 +149,10 @@ func (c *client) renewLease(leaseId string, leaseDuration time.Duration) (*vault
 // revokeLease calls the /sys/leases/revoke Vault endpoint. This endpoint
 // is NOT accessible with the default policy in Vault 1.7.2. See
 // https://www.vaultproject.io/api-docs/system/leases#revoke-lease.
-func (c *client) revokeLease(leaseId string) error {
+func (c *client) revokeLease(ctx context.Context, leaseId string) error {
 	const op = "vault.(client).revokeLease"
 	if err := c.cl.Sys().Revoke(leaseId); err != nil {
-		return errors.WrapDeprecated(err, op, errors.WithCode(errors.Unknown), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
+		return errors.Wrap(ctx, err, op, errors.WithCode(errors.Unknown), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
 	}
 	return nil
 }
@@ -161,33 +161,33 @@ func (c *client) revokeLease(leaseId string) error {
 // the vault.Secret response. This endpoint is accessible with the default
 // policy in Vault 1.7.2. See
 // https://www.vaultproject.io/api-docs/auth/token#lookup-a-token-self.
-func (c *client) lookupToken() (*vault.Secret, error) {
+func (c *client) lookupToken(ctx context.Context) (*vault.Secret, error) {
 	const op = "vault.(client).lookupToken"
 	t, err := c.cl.Auth().Token().LookupSelf()
 	if err != nil {
-		return nil, errors.WrapDeprecated(err, op, errors.WithCode(errors.Unknown), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
+		return nil, errors.Wrap(ctx, err, op, errors.WithCode(errors.Unknown), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
 	}
 	return t, nil
 }
 
 // swapToken replaces the token in the Vault client with t and returns the
 // token that was replaced.
-func (c *client) swapToken(new TokenSecret) (old TokenSecret) {
+func (c *client) swapToken(ctx context.Context, new TokenSecret) (old TokenSecret) {
 	old = TokenSecret(c.cl.Token())
 	c.cl.SetToken(string(new))
 	return
 }
 
-func (c *client) get(path string) (*vault.Secret, error) {
+func (c *client) get(ctx context.Context, path string) (*vault.Secret, error) {
 	const op = "vault.(client).get"
 	s, err := c.cl.Logical().Read(path)
 	if err != nil {
-		return nil, errors.WrapDeprecated(err, op, errors.WithCode(errors.VaultCredentialRequest), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
+		return nil, errors.Wrap(ctx, err, op, errors.WithCode(errors.VaultCredentialRequest), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
 	}
 	return s, nil
 }
 
-func (c *client) post(path string, data []byte) (*vault.Secret, error) {
+func (c *client) post(ctx context.Context, path string, data []byte) (*vault.Secret, error) {
 	const op = "vault.(client).post"
 
 	if len(data) == 0 {
@@ -197,7 +197,7 @@ func (c *client) post(path string, data []byte) (*vault.Secret, error) {
 	}
 	s, err := c.cl.Logical().WriteBytes(path, data)
 	if err != nil {
-		return nil, errors.WrapDeprecated(err, op, errors.WithCode(errors.VaultCredentialRequest), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
+		return nil, errors.Wrap(ctx, err, op, errors.WithCode(errors.VaultCredentialRequest), errors.WithMsg(fmt.Sprintf("vault: %s", c.cl.Address())))
 	}
 	return s, nil
 }
@@ -206,10 +206,10 @@ func (c *client) post(path string, data []byte) (*vault.Secret, error) {
 // the vault.Secret response. This endpoint is accessible with the default
 // policy in Vault 1.7.2. See
 // https://www.vaultproject.io/api-docs/system/capabilities-self.
-func (c *client) capabilities(paths []string) (pathCapabilities, error) {
+func (c *client) capabilities(ctx context.Context, paths []string) (pathCapabilities, error) {
 	const op = "vault.(client).capabilities"
 	if len(paths) == 0 {
-		return nil, errors.NewDeprecated(errors.InvalidParameter, op, "empty paths")
+		return nil, errors.New(ctx, errors.InvalidParameter, op, "empty paths")
 	}
 	body := map[string]string{
 		"paths": strings.Join(paths, ","),
@@ -234,7 +234,7 @@ func (c *client) capabilities(paths []string) (pathCapabilities, error) {
 		return nil, err
 	}
 	if secret == nil || secret.Data == nil {
-		return nil, errors.NewDeprecated(errors.Unknown, op, "data from Vault is empty")
+		return nil, errors.New(ctx, errors.Unknown, op, "data from Vault is empty")
 	}
 
 	var res map[string][]string
diff --git a/internal/credential/vault/vault_test.go b/internal/credential/vault/vault_test.go
index 1d2cf4744..2ce6eceb0 100644
--- a/internal/credential/vault/vault_test.go
+++ b/internal/credential/vault/vault_test.go
@@ -1,6 +1,7 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"net/http"
 	"path"
@@ -16,6 +17,7 @@ import (
 func Test_newClient(t *testing.T) {
 	t.Parallel()
 	v := NewTestVaultServer(t)
+	ctx := context.Background()
 
 	tests := []struct {
 		name         string
@@ -52,7 +54,7 @@ func Test_newClient(t *testing.T) {
 		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			client, err := newClient(tt.clientConfig)
+			client, err := newClient(ctx, tt.clientConfig)
 			if tt.wantErr {
 				require.Error(err)
 				assert.Nil(client)
@@ -66,6 +68,7 @@ func Test_newClient(t *testing.T) {
 
 func TestClient_RenewToken(t *testing.T) {
 	t.Parallel()
+	ctx := context.Background()
 	assert := assert.New(t)
 	v := NewTestVaultServer(t)
 
@@ -76,7 +79,7 @@ func TestClient_RenewToken(t *testing.T) {
 	time.Sleep(100 * time.Millisecond)
 
 	client := v.clientUsingToken(t, token)
-	renewedToken, err := client.renewToken()
+	renewedToken, err := client.renewToken(ctx)
 	require.NoError(t, err)
 	assert.NotNil(renewedToken)
 
@@ -102,6 +105,7 @@ func tokenExpirationTime(t *testing.T, s *vault.Secret) time.Time {
 
 func TestClient_LookupToken(t *testing.T) {
 	t.Parallel()
+	ctx := context.Background()
 	assert, require := assert.New(t), require.New(t)
 	v := NewTestVaultServer(t)
 
@@ -109,7 +113,7 @@ func TestClient_LookupToken(t *testing.T) {
 	secretLookup := v.LookupToken(t, token)
 
 	client := v.clientUsingToken(t, token)
-	tokenLookup, err := client.lookupToken()
+	tokenLookup, err := client.lookupToken(ctx)
 	assert.NoError(err)
 	require.NotNil(tokenLookup)
 
@@ -119,20 +123,21 @@ func TestClient_LookupToken(t *testing.T) {
 
 func TestClient_RevokeToken(t *testing.T) {
 	t.Parallel()
+	ctx := context.Background()
 	assert, require := assert.New(t), require.New(t)
 	v := NewTestVaultServer(t)
 
 	_, token := v.CreateToken(t)
 
 	client := v.clientUsingToken(t, token)
-	tokenLookup, err := client.lookupToken()
+	tokenLookup, err := client.lookupToken(ctx)
 	assert.NoError(err)
 	assert.NotNil(tokenLookup)
 
-	require.NoError(client.revokeToken())
+	require.NoError(client.revokeToken(ctx))
 
 	// An attempt to lookup should now fail with a 403
-	tokenLookup, err = client.lookupToken()
+	tokenLookup, err = client.lookupToken(ctx)
 	require.Error(err)
 	assert.Nil(tokenLookup)
 
@@ -144,19 +149,21 @@ func TestClient_RevokeToken(t *testing.T) {
 
 func TestClient_Get(t *testing.T) {
 	t.Parallel()
+	ctx := context.Background()
 	assert := assert.New(t)
 	v := NewTestVaultServer(t, WithDockerNetwork(true))
 	v.MountDatabase(t)
 
 	client := v.client(t)
 
-	cred, err := client.get(path.Join("database", "creds", "opened"))
+	cred, err := client.get(ctx, path.Join("database", "creds", "opened"))
 	assert.NoError(err)
 	assert.NotNil(cred)
 }
 
 func TestClient_Post(t *testing.T) {
 	t.Parallel()
+	ctx := context.Background()
 	v := NewTestVaultServer(t, WithTestVaultTLS(TestServerTLS))
 	v.MountPKI(t)
 	client := v.client(t)
@@ -164,13 +171,13 @@ func TestClient_Post(t *testing.T) {
 	t.Run("post-body", func(t *testing.T) {
 		assert := assert.New(t)
 		credData := []byte(`{"common_name":"boundary.com"}`)
-		cred, err := client.post(credPath, credData)
+		cred, err := client.post(ctx, credPath, credData)
 		assert.NoError(err)
 		assert.NotNil(cred)
 	})
 	t.Run("nil-body", func(t *testing.T) {
 		assert := assert.New(t)
-		cred, err := client.post(credPath, nil)
+		cred, err := client.post(ctx, credPath, nil)
 		assert.Error(err)
 		assert.Contains(err.Error(), "common_name field is required")
 		assert.Nil(cred)
@@ -179,6 +186,7 @@ func TestClient_Post(t *testing.T) {
 
 func TestClient_RenewLease(t *testing.T) {
 	t.Parallel()
+	ctx := context.Background()
 	assert, require := assert.New(t), require.New(t)
 	v := NewTestVaultServer(t, WithDockerNetwork(true))
 	v.MountDatabase(t)
@@ -187,7 +195,7 @@ func TestClient_RenewLease(t *testing.T) {
 	client := v.clientUsingToken(t, token)
 
 	// Create secret
-	cred, err := client.get(path.Join("database", "creds", "opened"))
+	cred, err := client.get(ctx, path.Join("database", "creds", "opened"))
 	assert.NoError(err)
 	require.NotNil(cred)
 
@@ -198,7 +206,7 @@ func TestClient_RenewLease(t *testing.T) {
 	// Verify lease has not been renewed
 	assert.Empty(leaseLookup.Data["last_renewal"])
 
-	renewedLease, err := client.renewLease(cred.LeaseID, time.Hour)
+	renewedLease, err := client.renewLease(ctx, cred.LeaseID, time.Hour)
 	assert.NoError(err)
 	require.NotNil(renewedLease)
 	assert.Equal(cred.LeaseID, renewedLease.LeaseID)
@@ -213,6 +221,7 @@ func TestClient_RenewLease(t *testing.T) {
 
 func TestClient_capabilities(t *testing.T) {
 	t.Parallel()
+	ctx := context.Background()
 	v := NewTestVaultServer(t)
 
 	tests := []struct {
@@ -245,7 +254,7 @@ func TestClient_capabilities(t *testing.T) {
 			_, token := v.CreateToken(t, WithPolicies(tt.polices))
 			client := v.clientUsingToken(t, token)
 
-			have, err := client.capabilities(tt.require.paths())
+			have, err := client.capabilities(ctx, tt.require.paths())
 			assert.NoError(err)
 			got := have.missing(tt.require)
 			assert.Equalf(tt.wantMissing, got, "pathCapabilities: want: {%s} got: {%s}", tt.wantMissing, got)
@@ -255,6 +264,7 @@ func TestClient_capabilities(t *testing.T) {
 
 func TestClient_revokeLease(t *testing.T) {
 	t.Parallel()
+	ctx := context.Background()
 	assert, require := assert.New(t), require.New(t)
 	v := NewTestVaultServer(t, WithDockerNetwork(true), WithTestVaultTLS(TestClientTLS))
 	testDatabase := v.MountDatabase(t)
@@ -262,7 +272,7 @@ func TestClient_revokeLease(t *testing.T) {
 	_, token := v.CreateToken(t, WithPolicies([]string{"boundary-controller", "database"}))
 	client := v.clientUsingToken(t, token)
 
-	cred, err := client.get(path.Join("database", "creds", "opened"))
+	cred, err := client.get(ctx, path.Join("database", "creds", "opened"))
 	assert.NoError(err)
 	require.NotNil(cred)
 
@@ -270,7 +280,7 @@ func TestClient_revokeLease(t *testing.T) {
 	assert.NoError(testDatabase.ValidateCredential(t, cred))
 
 	// revoke the database credentials
-	assert.NoError(client.revokeLease(cred.LeaseID))
+	assert.NoError(client.revokeLease(ctx, cred.LeaseID))
 
 	// verify the database credentials no longer work
 	assert.Error(testDatabase.ValidateCredential(t, cred))
diff --git a/internal/daemon/controller/handler.go b/internal/daemon/controller/handler.go
index 99454054e..4d8292215 100644
--- a/internal/daemon/controller/handler.go
+++ b/internal/daemon/controller/handler.go
@@ -212,7 +212,7 @@ func (c *Controller) registerGrpcServices(s *grpc.Server) error {
 		services.RegisterManagedGroupServiceServer(s, mgs)
 	}
 	if _, ok := currentServices[services.CredentialStoreService_ServiceDesc.ServiceName]; !ok {
-		cs, err := credentialstores.NewService(c.VaultCredentialRepoFn, c.StaticCredentialRepoFn, c.IamRepoFn)
+		cs, err := credentialstores.NewService(c.baseContext, c.VaultCredentialRepoFn, c.StaticCredentialRepoFn, c.IamRepoFn)
 		if err != nil {
 			return fmt.Errorf("failed to create credential store handler service: %w", err)
 		}
diff --git a/internal/daemon/controller/handlers/credentialstores/credentialstore_service.go b/internal/daemon/controller/handlers/credentialstores/credentialstore_service.go
index fb2ba7c79..ffd766037 100644
--- a/internal/daemon/controller/handlers/credentialstores/credentialstore_service.go
+++ b/internal/daemon/controller/handlers/credentialstores/credentialstore_service.go
@@ -94,19 +94,20 @@ type Service struct {
 
 // NewService returns a credential store service which handles credential store related requests to boundary.
 func NewService(
+	ctx context.Context,
 	vaultRepo common.VaultCredentialRepoFactory,
 	staticRepo common.StaticCredentialRepoFactory,
 	iamRepo common.IamRepoFactory,
 ) (Service, error) {
 	const op = "credentialstores.NewService"
 	if iamRepo == nil {
-		return Service{}, errors.NewDeprecated(errors.InvalidParameter, op, "missing iam repository")
+		return Service{}, errors.New(ctx, errors.InvalidParameter, op, "missing iam repository")
 	}
 	if vaultRepo == nil {
-		return Service{}, errors.NewDeprecated(errors.InvalidParameter, op, "missing vault credential repository")
+		return Service{}, errors.New(ctx, errors.InvalidParameter, op, "missing vault credential repository")
 	}
 	if staticRepo == nil {
-		return Service{}, errors.NewDeprecated(errors.InvalidParameter, op, "missing static credential repository")
+		return Service{}, errors.New(ctx, errors.InvalidParameter, op, "missing static credential repository")
 	}
 	return Service{iamRepoFn: iamRepo, vaultRepoFn: vaultRepo, staticRepoFn: staticRepo}, nil
 }
@@ -183,7 +184,7 @@ func (s Service) ListCredentialStores(ctx context.Context, req *pbs.ListCredenti
 			outputOpts = append(outputOpts, handlers.WithAuthorizedCollectionActions(collectionActions))
 		}
 
-		item, err := toProto(item, outputOpts...)
+		item, err := toProto(ctx, item, outputOpts...)
 		if err != nil {
 			return nil, err
 		}
@@ -236,7 +237,7 @@ func (s Service) GetCredentialStore(ctx context.Context, req *pbs.GetCredentialS
 		outputOpts = append(outputOpts, handlers.WithAuthorizedCollectionActions(collectionActions))
 	}
 
-	item, err := toProto(cs, outputOpts...)
+	item, err := toProto(ctx, cs, outputOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -248,7 +249,7 @@ func (s Service) GetCredentialStore(ctx context.Context, req *pbs.GetCredentialS
 func (s Service) CreateCredentialStore(ctx context.Context, req *pbs.CreateCredentialStoreRequest) (*pbs.CreateCredentialStoreResponse, error) {
 	const op = "credentialstores.(Service).CreateCredentialStore"
 
-	if err := validateCreateRequest(req); err != nil {
+	if err := validateCreateRequest(ctx, req); err != nil {
 		return nil, err
 	}
 	authResults := s.authResult(ctx, req.GetItem().GetScopeId(), action.Create)
@@ -281,7 +282,7 @@ func (s Service) CreateCredentialStore(ctx context.Context, req *pbs.CreateCrede
 		outputOpts = append(outputOpts, handlers.WithAuthorizedCollectionActions(collectionActions))
 	}
 
-	item, err := toProto(cs, outputOpts...)
+	item, err := toProto(ctx, cs, outputOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -296,7 +297,7 @@ func (s Service) CreateCredentialStore(ctx context.Context, req *pbs.CreateCrede
 func (s Service) UpdateCredentialStore(ctx context.Context, req *pbs.UpdateCredentialStoreRequest) (*pbs.UpdateCredentialStoreResponse, error) {
 	const op = "credentialstores.(Service).UpdateCredentialStore"
 
-	if err := validateUpdateRequest(req); err != nil {
+	if err := validateUpdateRequest(ctx, req); err != nil {
 		return nil, err
 	}
 	authResults := s.authResult(ctx, req.GetId(), action.Update)
@@ -329,7 +330,7 @@ func (s Service) UpdateCredentialStore(ctx context.Context, req *pbs.UpdateCrede
 		outputOpts = append(outputOpts, handlers.WithAuthorizedCollectionActions(collectionActions))
 	}
 
-	item, err := toProto(cs, outputOpts...)
+	item, err := toProto(ctx, cs, outputOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -424,7 +425,7 @@ func (s Service) createInRepo(ctx context.Context, projId string, item *pb.Crede
 
 	switch item.Type {
 	case vault.Subtype.String():
-		cs, err := toStorageVaultStore(projId, item)
+		cs, err := toStorageVaultStore(ctx, projId, item)
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
 		}
@@ -439,7 +440,7 @@ func (s Service) createInRepo(ctx context.Context, projId string, item *pb.Crede
 		return out, nil
 
 	case static.Subtype.String():
-		cs, err := toStorageStaticStore(projId, item)
+		cs, err := toStorageStaticStore(ctx, projId, item)
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
 		}
@@ -471,7 +472,7 @@ func (s Service) updateInRepo(ctx context.Context, projId, id string, mask []str
 
 	switch subtypes.SubtypeFromId(domain, id) {
 	case vault.Subtype:
-		cs, err := toStorageVaultStore(projId, item)
+		cs, err := toStorageVaultStore(ctx, projId, item)
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
 		}
@@ -487,7 +488,7 @@ func (s Service) updateInRepo(ctx context.Context, projId, id string, mask []str
 		}
 
 	case static.Subtype:
-		cs, err := toStorageStaticStore(projId, item)
+		cs, err := toStorageStaticStore(ctx, projId, item)
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
 		}
@@ -607,7 +608,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.
 	return auth.Verify(ctx, opts...)
 }
 
-func toProto(in credential.Store, opt ...handlers.Option) (*pb.CredentialStore, error) {
+func toProto(ctx context.Context, in credential.Store, opt ...handlers.Option) (*pb.CredentialStore, error) {
 	const op = "credentialstores.toProto"
 
 	opts := handlers.GetOpts(opt...)
@@ -655,7 +656,7 @@ func toProto(in credential.Store, opt ...handlers.Option) (*pb.CredentialStore,
 		case vault.Subtype:
 			vaultIn, ok := in.(*vault.CredentialStore)
 			if !ok {
-				return nil, errors.NewDeprecated(errors.Internal, op, "unable to cast to vault credential store")
+				return nil, errors.New(ctx, errors.Internal, op, "unable to cast to vault credential store")
 			}
 			attrs := &pb.VaultCredentialStoreAttributes{
 				Address: wrapperspb.String(vaultIn.GetVaultAddress()),
@@ -695,7 +696,7 @@ func toProto(in credential.Store, opt ...handlers.Option) (*pb.CredentialStore,
 	return &out, nil
 }
 
-func toStorageStaticStore(scopeId string, in *pb.CredentialStore) (out *static.CredentialStore, err error) {
+func toStorageStaticStore(ctx context.Context, scopeId string, in *pb.CredentialStore) (out *static.CredentialStore, err error) {
 	const op = "credentialstores.toStorageStaticStore"
 	var opts []static.Option
 	if in.GetName() != nil {
@@ -707,12 +708,12 @@ func toStorageStaticStore(scopeId string, in *pb.CredentialStore) (out *static.C
 
 	cs, err := static.NewCredentialStore(scopeId, opts...)
 	if err != nil {
-		return nil, errors.WrapDeprecated(err, op, errors.WithMsg("unable to build credential store for creation"))
+		return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to build credential store for creation"))
 	}
 	return cs, err
 }
 
-func toStorageVaultStore(scopeId string, in *pb.CredentialStore) (out *vault.CredentialStore, err error) {
+func toStorageVaultStore(ctx context.Context, scopeId string, in *pb.CredentialStore) (out *vault.CredentialStore, err error) {
 	const op = "credentialstores.toStorageVaultStore"
 	var opts []vault.Option
 	if in.GetName() != nil {
@@ -741,9 +742,9 @@ func toStorageVaultStore(scopeId string, in *pb.CredentialStore) (out *vault.Cre
 	if attrs.GetCaCert() != nil {
 		opts = append(opts, vault.WithCACert([]byte(attrs.GetCaCert().GetValue())))
 	}
-	pemCerts, pemPk, err := extractClientCertAndPk(attrs.GetClientCertificate().GetValue(), attrs.GetClientCertificateKey().GetValue())
+	pemCerts, pemPk, err := extractClientCertAndPk(ctx, attrs.GetClientCertificate().GetValue(), attrs.GetClientCertificateKey().GetValue())
 	if err != nil {
-		return nil, errors.WrapDeprecated(err, op)
+		return nil, errors.Wrap(ctx, err, op)
 	}
 	if len(pemCerts) != 0 {
 		var cert []byte
@@ -756,14 +757,14 @@ func toStorageVaultStore(scopeId string, in *pb.CredentialStore) (out *vault.Cre
 		}
 		cc, err := vault.NewClientCertificate(cert, pk)
 		if err != nil {
-			return nil, errors.WrapDeprecated(err, op)
+			return nil, errors.Wrap(ctx, err, op)
 		}
 		opts = append(opts, vault.WithClientCert(cc))
 	}
 
 	cs, err := vault.NewCredentialStore(scopeId, attrs.GetAddress().GetValue(), []byte(attrs.GetToken().GetValue()), opts...)
 	if err != nil {
-		return nil, errors.WrapDeprecated(err, op, errors.WithMsg("unable to build credential store for creation"))
+		return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to build credential store for creation"))
 	}
 	return cs, err
 }
@@ -777,7 +778,7 @@ func validateGetRequest(req *pbs.GetCredentialStoreRequest) error {
 	return handlers.ValidateGetRequest(handlers.NoopValidatorFn, req, vault.CredentialStorePrefix, static.CredentialStorePrefix, static.PreviousCredentialStorePrefix)
 }
 
-func validateCreateRequest(req *pbs.CreateCredentialStoreRequest) error {
+func validateCreateRequest(ctx context.Context, req *pbs.CreateCredentialStoreRequest) error {
 	return handlers.ValidateCreateRequest(req.GetItem(), func() map[string]string {
 		badFields := map[string]string{}
 		if !handlers.ValidId(handlers.Id(req.GetItem().GetScopeId()), scope.Project.Prefix()) {
@@ -806,12 +807,12 @@ func validateCreateRequest(req *pbs.CreateCredentialStoreRequest) error {
 				}
 			}
 			// TODO(ICU-1478 and ICU-1479): Validate client and CA certificate payloads
-			_, err := decodePemBlocks(attrs.GetCaCert().GetValue())
+			_, err := decodePemBlocks(ctx, attrs.GetCaCert().GetValue())
 			if attrs.GetCaCert() != nil && err != nil {
 				badFields[caCertsField] = "Incorrectly formatted value."
 			}
 
-			cs, pk, err := extractClientCertAndPk(attrs.GetClientCertificate().GetValue(), attrs.GetClientCertificateKey().GetValue())
+			cs, pk, err := extractClientCertAndPk(ctx, attrs.GetClientCertificate().GetValue(), attrs.GetClientCertificateKey().GetValue())
 			if err != nil {
 				badFields[clientCertField] = fmt.Sprintf("Invalid values: %q", err.Error())
 			}
@@ -830,7 +831,7 @@ func validateCreateRequest(req *pbs.CreateCredentialStoreRequest) error {
 	})
 }
 
-func validateUpdateRequest(req *pbs.UpdateCredentialStoreRequest) error {
+func validateUpdateRequest(ctx context.Context, req *pbs.UpdateCredentialStoreRequest) error {
 	return handlers.ValidateUpdateRequest(req, req.GetItem(), func() map[string]string {
 		badFields := map[string]string{}
 		switch subtypes.SubtypeFromId(domain, req.GetId()) {
@@ -859,12 +860,12 @@ func validateUpdateRequest(req *pbs.UpdateCredentialStoreRequest) error {
 				}
 
 				// TODO(ICU-1478 and ICU-1479): Validate client and CA certificate payloads
-				_, err := decodePemBlocks(attrs.GetCaCert().GetValue())
+				_, err := decodePemBlocks(ctx, attrs.GetCaCert().GetValue())
 				if attrs.GetCaCert() != nil && err != nil {
 					badFields[caCertsField] = "Incorrectly formatted value."
 				}
 
-				_, _, err = extractClientCertAndPk(attrs.GetClientCertificate().GetValue(), attrs.GetClientCertificateKey().GetValue())
+				_, _, err = extractClientCertAndPk(ctx, attrs.GetClientCertificate().GetValue(), attrs.GetClientCertificateKey().GetValue())
 				if err != nil {
 					badFields[clientCertField] = fmt.Sprintf("Invalid values: %q", err.Error())
 				}
diff --git a/internal/daemon/controller/handlers/credentialstores/credentialstore_service_test.go b/internal/daemon/controller/handlers/credentialstores/credentialstore_service_test.go
index a4e9f7ade..8b8a15eba 100644
--- a/internal/daemon/controller/handlers/credentialstores/credentialstore_service_test.go
+++ b/internal/daemon/controller/handlers/credentialstores/credentialstore_service_test.go
@@ -57,6 +57,7 @@ var (
 )
 
 func TestList(t *testing.T) {
+	ctx := context.Background()
 	conn, _ := db.TestSetup(t, "postgres")
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
@@ -168,7 +169,7 @@ func TestList(t *testing.T) {
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
-			s, err := NewService(vaultRepoFn, staticRepoFn, iamRepoFn)
+			s, err := NewService(ctx, vaultRepoFn, staticRepoFn, iamRepoFn)
 			require.NoError(t, err, "Couldn't create new host set service.")
 
 			// Test non-anonymous listing
@@ -197,6 +198,7 @@ func TestList(t *testing.T) {
 }
 
 func TestCreateVault(t *testing.T) {
+	ctx := context.Background()
 	conn, _ := db.TestSetup(t, "postgres")
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
@@ -524,7 +526,7 @@ func TestCreateVault(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
 
-			s, err := NewService(vaultRepoFn, staticRepoFn, iamRepoFn)
+			s, err := NewService(ctx, vaultRepoFn, staticRepoFn, iamRepoFn)
 			require.NoError(err, "Error when getting new credential store service.")
 			defer cleanup(s)
 
@@ -577,6 +579,7 @@ func TestCreateVault(t *testing.T) {
 }
 
 func TestCreateStatic(t *testing.T) {
+	ctx := context.Background()
 	conn, _ := db.TestSetup(t, "postgres")
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
@@ -700,7 +703,7 @@ func TestCreateStatic(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
 
-			s, err := NewService(vaultRepoFn, staticRepoFn, iamRepoFn)
+			s, err := NewService(ctx, vaultRepoFn, staticRepoFn, iamRepoFn)
 			require.NoError(err, "Error when getting new credential store service.")
 			defer cleanup(s)
 
@@ -742,6 +745,7 @@ func TestCreateStatic(t *testing.T) {
 }
 
 func TestGet(t *testing.T) {
+	ctx := context.Background()
 	conn, _ := db.TestSetup(t, "postgres")
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
@@ -764,7 +768,7 @@ func TestGet(t *testing.T) {
 	vaultStore := vault.TestCredentialStores(t, conn, wrapper, prj.GetPublicId(), 1)[0]
 	staticStore := credstatic.TestCredentialStore(t, conn, wrapper, prj.GetPublicId())
 	staticStorePrev := credstatic.TestCredentialStore(t, conn, wrapper, prj.GetPublicId(), credstatic.WithPublicId(fmt.Sprintf("%s_1234567890", credstatic.PreviousCredentialStorePrefix)))
-	s, err := NewService(vaultRepoFn, staticRepoFn, iamRepoFn)
+	s, err := NewService(ctx, vaultRepoFn, staticRepoFn, iamRepoFn)
 	require.NoError(t, err)
 
 	cases := []struct {
@@ -872,6 +876,7 @@ func TestGet(t *testing.T) {
 }
 
 func TestDelete(t *testing.T) {
+	ctx := context.Background()
 	conn, _ := db.TestSetup(t, "postgres")
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
@@ -895,7 +900,7 @@ func TestDelete(t *testing.T) {
 
 	vaultStore := vault.TestCredentialStores(t, conn, wrapper, prj.GetPublicId(), 2)[0]
 	staticStore := credstatic.TestCredentialStore(t, conn, wrapper, prj.GetPublicId())
-	s, err := NewService(vaultRepoFn, staticRepoFn, iamRepoFn)
+	s, err := NewService(ctx, vaultRepoFn, staticRepoFn, iamRepoFn)
 	require.NoError(t, err)
 
 	cases := []struct {
@@ -968,7 +973,7 @@ func TestUpdateVault(t *testing.T) {
 	_, prj := iam.TestScopes(t, iamRepo)
 	ctx := auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId())
 
-	s, err := NewService(vaultRepoFn, staticRepoFn, iamRepoFn)
+	s, err := NewService(ctx, vaultRepoFn, staticRepoFn, iamRepoFn)
 	require.NoError(t, err)
 
 	fieldmask := func(paths ...string) *fieldmaskpb.FieldMask {
@@ -1300,7 +1305,7 @@ func TestUpdateStatic(t *testing.T) {
 	_, prj := iam.TestScopes(t, iamRepo)
 	ctx := auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId())
 
-	s, err := NewService(vaultRepoFn, staticRepoFn, iamRepoFn)
+	s, err := NewService(ctx, vaultRepoFn, staticRepoFn, iamRepoFn)
 	require.NoError(t, err)
 
 	fieldmask := func(paths ...string) *fieldmaskpb.FieldMask {
diff --git a/internal/daemon/controller/handlers/credentialstores/vault.go b/internal/daemon/controller/handlers/credentialstores/vault.go
index d4aa7c13a..3599c2041 100644
--- a/internal/daemon/controller/handlers/credentialstores/vault.go
+++ b/internal/daemon/controller/handlers/credentialstores/vault.go
@@ -1,6 +1,7 @@
 package credentialstores
 
 import (
+	"context"
 	"encoding/pem"
 	"fmt"
 	"strings"
@@ -12,11 +13,11 @@ import (
 // certificate and client certificate key and parses them into pem blocks.
 // Any non certificate pem blocks are treated as a private key. An error is
 // returned if there is more than 1 private key provided across both fields.
-func extractClientCertAndPk(cert, pk string) ([]*pem.Block, *pem.Block, error) {
+func extractClientCertAndPk(ctx context.Context, cert, pk string) ([]*pem.Block, *pem.Block, error) {
 	const op = "credentialstores.extractClientCertAndPk"
-	pks, err := decodePemBlocks(pk)
+	pks, err := decodePemBlocks(ctx, pk)
 	if err != nil {
-		return nil, nil, errors.WrapDeprecated(err, op, errors.WithMsg("failed to parse client certificate private key"))
+		return nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("failed to parse client certificate private key"))
 	}
 	var pkPem *pem.Block
 	switch len(pks) {
@@ -24,12 +25,12 @@ func extractClientCertAndPk(cert, pk string) ([]*pem.Block, *pem.Block, error) {
 	case 1:
 		pkPem = pks[0]
 	default:
-		return nil, nil, errors.NewDeprecated(errors.InvalidParameter, op, "private key payload contained multiple pem blocks")
+		return nil, nil, errors.New(ctx, errors.InvalidParameter, op, "private key payload contained multiple pem blocks")
 	}
 
-	bs, err := decodePemBlocks(cert)
+	bs, err := decodePemBlocks(ctx, cert)
 	if err != nil {
-		return nil, nil, errors.WrapDeprecated(err, op, errors.WithMsg("failed to parse client certificate into pem blocks"))
+		return nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("failed to parse client certificate into pem blocks"))
 	}
 	pkIdx := -1
 	for i, b := range bs {
@@ -38,9 +39,9 @@ func extractClientCertAndPk(cert, pk string) ([]*pem.Block, *pem.Block, error) {
 			case pkPem == nil:
 				pkIdx, pkPem = i, b
 			case pkIdx < 0:
-				return nil, nil, errors.NewDeprecated(errors.InvalidParameter, op, "client certificate contains a private key when one was also provided separately")
+				return nil, nil, errors.New(ctx, errors.InvalidParameter, op, "client certificate contains a private key when one was also provided separately")
 			default:
-				return nil, nil, errors.NewDeprecated(errors.InvalidParameter, op, fmt.Sprintf("second primary key found at %d after previous one found at %d", i, pkIdx))
+				return nil, nil, errors.New(ctx, errors.InvalidParameter, op, fmt.Sprintf("second primary key found at %d after previous one found at %d", i, pkIdx))
 			}
 		}
 	}
@@ -50,7 +51,7 @@ func extractClientCertAndPk(cert, pk string) ([]*pem.Block, *pem.Block, error) {
 	return bs, pkPem, nil
 }
 
-func decodePemBlocks(input string) ([]*pem.Block, error) {
+func decodePemBlocks(ctx context.Context, input string) ([]*pem.Block, error) {
 	const op = "credentialstores.decodePemBlocks"
 	cpIn := make([]byte, len(input))
 	copy(cpIn, input)
@@ -64,7 +65,7 @@ func decodePemBlocks(input string) ([]*pem.Block, error) {
 		ret = append(ret, p)
 	}
 	if len(cpIn) > 0 {
-		return nil, errors.NewDeprecated(errors.InvalidParameter, op, "not all data parseable by pem block")
+		return nil, errors.New(ctx, errors.InvalidParameter, op, "not all data parseable by pem block")
 	}
 	return ret, nil
 }
diff --git a/internal/daemon/controller/handlers/credentialstores/vault_test.go b/internal/daemon/controller/handlers/credentialstores/vault_test.go
index b330a6ddf..53b2733e4 100644
--- a/internal/daemon/controller/handlers/credentialstores/vault_test.go
+++ b/internal/daemon/controller/handlers/credentialstores/vault_test.go
@@ -1,6 +1,7 @@
 package credentialstores
 
 import (
+	"context"
 	"encoding/pem"
 	"testing"
 
@@ -10,10 +11,11 @@ import (
 )
 
 func TestPkAndClientCerts(t *testing.T) {
+	ctx := context.Background()
 	s := vault.NewTestVaultServer(t, vault.WithTestVaultTLS(vault.TestClientTLS))
 
 	t.Run("seperate client cert and key", func(t *testing.T) {
-		c, k, err := extractClientCertAndPk(string(s.ClientCert), string(s.ClientKey))
+		c, k, err := extractClientCertAndPk(ctx, string(s.ClientCert), string(s.ClientKey))
 		assert.NoError(t, err)
 		require.NotNil(t, k)
 		assert.Equal(t, s.ClientKey, pem.EncodeToMemory(k))
@@ -22,7 +24,7 @@ func TestPkAndClientCerts(t *testing.T) {
 	})
 
 	t.Run("client cert and key bundled in cert", func(t *testing.T) {
-		c, k, err := extractClientCertAndPk(string(s.ClientCert)+string(s.ClientKey), "")
+		c, k, err := extractClientCertAndPk(ctx, string(s.ClientCert)+string(s.ClientKey), "")
 		assert.NoError(t, err)
 		require.NotNil(t, k)
 		assert.Equal(t, s.ClientKey, pem.EncodeToMemory(k))
@@ -31,7 +33,7 @@ func TestPkAndClientCerts(t *testing.T) {
 	})
 
 	t.Run("cert with no private key", func(t *testing.T) {
-		c, k, err := extractClientCertAndPk(string(s.ClientCert), "")
+		c, k, err := extractClientCertAndPk(ctx, string(s.ClientCert), "")
 		assert.NoError(t, err)
 		assert.Nil(t, k)
 		require.Len(t, c, 1)
@@ -39,7 +41,7 @@ func TestPkAndClientCerts(t *testing.T) {
 	})
 
 	t.Run("private key with no cert", func(t *testing.T) {
-		c, k, err := extractClientCertAndPk("", string(s.ClientKey))
+		c, k, err := extractClientCertAndPk(ctx, "", string(s.ClientKey))
 		assert.NoError(t, err)
 		assert.NotNil(t, k)
 		assert.Equal(t, s.ClientKey, pem.EncodeToMemory(k))
@@ -47,13 +49,13 @@ func TestPkAndClientCerts(t *testing.T) {
 	})
 
 	t.Run("error cases", func(t *testing.T) {
-		_, _, err := extractClientCertAndPk(string(s.ClientCert), "invalid key")
+		_, _, err := extractClientCertAndPk(ctx, string(s.ClientCert), "invalid key")
 		assert.Error(t, err)
-		_, _, err = extractClientCertAndPk("invalid cert", string(s.ClientKey))
+		_, _, err = extractClientCertAndPk(ctx, "invalid cert", string(s.ClientKey))
 		assert.Error(t, err)
 
 		// private key with the cert and the private key
-		c, k, err := extractClientCertAndPk(string(s.ClientCert)+string(s.ClientKey), string(s.ClientKey))
+		c, k, err := extractClientCertAndPk(ctx, string(s.ClientCert)+string(s.ClientKey), string(s.ClientKey))
 		assert.Error(t, err)
 		assert.Nil(t, k)
 		assert.Empty(t, c)