diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0096a7f21b..d70e9ffb71 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -83,6 +83,8 @@ Main (unreleased)
 - Update `prometheus.exporter.snowflake` with the [latest](https://github.com/grafana/snowflake-prometheus-exporter) version of the exporter as of May 28, 2024 (@StefanKurek)
   - Fixes issue where returned `NULL` values from database could cause unexpected errors.
 
+- Bubble up SSH key conversion error to facilitate failed `import.git`. (@hainenber)
+
 ### Other changes
 
 - `pyroscope.ebpf`, `pyroscope.java`, `pyroscope.scrape`, `pyroscope.write` and `discovery.process` components are now GA. (@korniltsev)
diff --git a/internal/vcs/auth.go b/internal/vcs/auth.go
index b9d0610734..7e8960a4c5 100644
--- a/internal/vcs/auth.go
+++ b/internal/vcs/auth.go
@@ -16,20 +16,18 @@ type GitAuthConfig struct {
 
 // Convert converts HTTPClientConfig to the native Prometheus type. If h is
 // nil, the default client config is returned.
-func (h *GitAuthConfig) Convert() transport.AuthMethod {
+func (h *GitAuthConfig) Convert() (transport.AuthMethod, error) {
 	if h == nil {
-		return nil
+		return nil, nil
 	}
-
 	if h.BasicAuth != nil {
-		return h.BasicAuth.Convert()
+		return h.BasicAuth.Convert(), nil
 	}
 
 	if h.SSHKey != nil {
-		key, _ := h.SSHKey.Convert()
-		return key
+		return h.SSHKey.Convert()
 	}
-	return nil
+	return nil, nil
 }
 
 type BasicAuth struct {
diff --git a/internal/vcs/git.go b/internal/vcs/git.go
index 41bd209490..fead62c611 100644
--- a/internal/vcs/git.go
+++ b/internal/vcs/git.go
@@ -40,11 +40,19 @@ func NewGitRepo(ctx context.Context, storagePath string, opts GitRepoOptions) (*
 		err  error
 	)
 
+	authConfig, err := opts.Auth.Convert()
+	if err != nil {
+		return nil, DownloadFailedError{
+			Repository: opts.Repository,
+			Inner:      err,
+		}
+	}
+
 	if !isRepoCloned(storagePath) {
 		repo, err = git.PlainCloneContext(ctx, storagePath, false, &git.CloneOptions{
 			URL:               opts.Repository,
 			ReferenceName:     plumbing.HEAD,
-			Auth:              opts.Auth.Convert(),
+			Auth:              authConfig,
 			RecurseSubmodules: git.DefaultSubmoduleRecursionDepth,
 			Tags:              git.AllTags,
 		})
@@ -69,7 +77,7 @@ func NewGitRepo(ctx context.Context, storagePath string, opts GitRepoOptions) (*
 	pullRepoErr := wt.PullContext(ctx, &git.PullOptions{
 		RemoteName: "origin",
 		Force:      true,
-		Auth:       opts.Auth.Convert(),
+		Auth:       authConfig,
 	})
 	if pullRepoErr != nil && !errors.Is(pullRepoErr, git.NoErrAlreadyUpToDate) {
 		workTree, err := repo.Worktree()
@@ -109,10 +117,18 @@ func isRepoCloned(dir string) bool {
 // Update updates the repository by pulling new content and re-checking out to
 // latest version of Revision.
 func (repo *GitRepo) Update(ctx context.Context) error {
+	authConfig, err := repo.opts.Auth.Convert()
+	if err != nil {
+		return UpdateFailedError{
+			Repository: repo.opts.Repository,
+			Inner:      err,
+		}
+	}
+
 	pullRepoErr := repo.workTree.PullContext(ctx, &git.PullOptions{
 		RemoteName: "origin",
 		Force:      true,
-		Auth:       repo.opts.Auth.Convert(),
+		Auth:       authConfig,
 	})
 	if pullRepoErr != nil && !errors.Is(pullRepoErr, git.NoErrAlreadyUpToDate) {
 		return UpdateFailedError{