diff --git a/lib/autoupdate/tools/updater.go b/lib/autoupdate/tools/updater.go
index 9943900b2e1e8..e75d532d8883e 100644
--- a/lib/autoupdate/tools/updater.go
+++ b/lib/autoupdate/tools/updater.go
@@ -188,18 +188,17 @@ func (u *Updater) CheckRemote(ctx context.Context, proxyAddr string, insecure bo
 	// If a version of client tools has already been downloaded to
 	// tools directory, return that.
 	toolsVersion, err := CheckToolVersion(u.toolsDir)
-	if trace.IsNotFound(err) {
-		return u.localVersion, false, nil
-	}
-	if err != nil {
+	if err != nil && !trace.IsNotFound(err) {
 		return "", false, trace.Wrap(err)
 	}
 
 	switch {
 	case !resp.AutoUpdate.ToolsAutoUpdate || resp.AutoUpdate.ToolsVersion == "":
-		return toolsVersion, true, nil
+		if toolsVersion == "" {
+			return u.localVersion, false, nil
+		}
 	case u.localVersion == resp.AutoUpdate.ToolsVersion:
-		return resp.AutoUpdate.ToolsVersion, false, nil
+		return u.localVersion, false, nil
 	case resp.AutoUpdate.ToolsVersion != toolsVersion:
 		return resp.AutoUpdate.ToolsVersion, true, nil
 	}
diff --git a/tool/tsh/common/tsh.go b/tool/tsh/common/tsh.go
index 25413cc6fdc9d..fc732697ead6d 100644
--- a/tool/tsh/common/tsh.go
+++ b/tool/tsh/common/tsh.go
@@ -1992,7 +1992,7 @@ func onLogin(cf *CLIConf) error {
 		default:
 			// The user is logged in and has typed in `tsh --proxy=... login`, if
 			// the running binary needs to be updated, update and re-exec.
-			if err := updateAndRun(context.Background(), tc.WebProxyAddr, tc.InsecureSkipVerify); err != nil {
+			if err := updateAndRun(cf.Context, tc.WebProxyAddr, tc.InsecureSkipVerify); err != nil {
 				return trace.Wrap(err)
 			}
 		}