diff --git a/client/internal/connect.go b/client/internal/connect.go
index 2c55c2b28..c13df0888 100644
--- a/client/internal/connect.go
+++ b/client/internal/connect.go
@@ -177,6 +177,9 @@ func RunClient(ctx context.Context, config *Config, statusRecorder *nbStatus.Sta
 	err = backoff.Retry(operation, backOff)
 	if err != nil {
 		log.Debugf("exiting client retry loop due to unrecoverable error: %s", err)
+		if s, ok := gstatus.FromError(err); ok && (s.Code() == codes.PermissionDenied) {
+			state.Set(StatusNeedsLogin)
+		}
 		return err
 	}
 	return nil
diff --git a/client/server/server.go b/client/server/server.go
index 2beeca609..a5fb3423b 100644
--- a/client/server/server.go
+++ b/client/server/server.go
@@ -335,7 +335,7 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 }
 
 // Up starts engine work in the daemon.
-func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpResponse, error) {
+func (s *Server) Up(callerCtx context.Context, _ *proto.UpRequest) (*proto.UpResponse, error) {
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 
@@ -375,7 +375,7 @@ func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpR
 
 	go func() {
 		if err := internal.RunClient(ctx, s.config, s.statusRecorder); err != nil {
-			log.Errorf("run client connection: %v", state.Wrap(err))
+			log.Errorf("run client connection: %v", err)
 			return
 		}
 	}()
@@ -384,7 +384,7 @@ func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpR
 }
 
 // Down engine work in the daemon.
-func (s *Server) Down(ctx context.Context, msg *proto.DownRequest) (*proto.DownResponse, error) {
+func (s *Server) Down(_ context.Context, _ *proto.DownRequest) (*proto.DownResponse, error) {
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 
@@ -392,6 +392,8 @@ func (s *Server) Down(ctx context.Context, msg *proto.DownRequest) (*proto.DownR
 		return nil, fmt.Errorf("service is not up")
 	}
 	s.actCancel()
+	state := internal.CtxGetState(s.rootCtx)
+	state.Set(internal.StatusIdle)
 
 	return &proto.DownResponse{}, nil
 }
@@ -425,7 +427,7 @@ func (s *Server) Status(
 }
 
 // GetConfig of the daemon.
-func (s *Server) GetConfig(ctx context.Context, msg *proto.GetConfigRequest) (*proto.GetConfigResponse, error) {
+func (s *Server) GetConfig(_ context.Context, _ *proto.GetConfigRequest) (*proto.GetConfigResponse, error) {
 	s.mutex.Lock()
 	defer s.mutex.Unlock()