diff --git a/pkg/tunnel/connerror.go b/pkg/tunnel/connerror.go
index ddbe27179..0361a4801 100644
--- a/pkg/tunnel/connerror.go
+++ b/pkg/tunnel/connerror.go
@@ -38,6 +38,9 @@ func IsEOF(err error) bool {
 
 func ClassifyTunnelErrors(tunnelErr, handlerErr error) error {
 	if handlerErr == nil {
+		if ClassifyError(tunnelErr) == ErrorPermanent {
+			return fmt.Errorf("agent command: %w", tunnelErr)
+		}
 		return nil
 	}
 	if IsEOF(handlerErr) {
diff --git a/pkg/tunnel/connerror_test.go b/pkg/tunnel/connerror_test.go
index 176c77a0c..365c29031 100644
--- a/pkg/tunnel/connerror_test.go
+++ b/pkg/tunnel/connerror_test.go
@@ -72,7 +72,10 @@ func TestClassifyTunnelErrors(t *testing.T) {
 		wantNil    bool
 		wantSubstr string
 	}{
-		{"handler nil", tunnelErr, nil, true, ""},
+		{"handler nil, no tunnel err", nil, nil, true, ""},
+		{"handler nil, permanent tunnel err", tunnelErr, nil, false, "agent command: dial failed"},
+		{"handler nil, shutdown tunnel err", context.Canceled, nil, true, ""},
+		{"handler nil, EOF tunnel err", io.EOF, nil, true, ""},
 		{"handler EOF with tunnel err", tunnelErr, io.EOF, false, "connect to server: dial failed"},
 		{"handler EOF no tunnel err", nil, io.EOF, true, ""},
 		{"handler non-EOF", nil, handlerNonEOF, false, "tunnel to container: handler broke"},