diff --git a/client/internal/connect.go b/client/internal/connect.go
index a3af9ffd4..363725c7f 100644
--- a/client/internal/connect.go
+++ b/client/internal/connect.go
@@ -296,7 +296,10 @@ func (c *ConnectClient) run(runCtx context.Context, config *profilemanager.Confi
 			log.Debug(err)
 			if s, ok := gstatus.FromError(err); ok && (s.Code() == codes.PermissionDenied) {
 				state.Set(StatusNeedsLogin)
-				_ = c.Stop()
+				// Called from inside the run goroutine: tear the engine down
+				// directly, never through the lifecycle queue (sup.stop would
+				// deadlock — the supervisor would wait for this very run to end).
+				_ = c.stopEngine()
 				return backoff.Permanent(wrapErr(err)) // unrecoverable error
 			}
 			return wrapErr(err)