diff --git a/plugins/auth-node/src/IdentityClient.test.ts b/plugins/auth-node/src/IdentityClient.test.ts
index 7ef0b0c2e2..5efc85cb21 100644
--- a/plugins/auth-node/src/IdentityClient.test.ts
+++ b/plugins/auth-node/src/IdentityClient.test.ts
@@ -273,9 +273,11 @@ describe('IdentityClient', () => {
       discovery.getExternalBaseUrl = async () => {
         return updatedURL;
       };
+      let calledUpdatedEndpoint = false;
       server.use(
         rest.get(`${updatedURL}/.well-known/jwks.json`, async (_, res, ctx) => {
           const keys = await factory.listPublicKeys();
+          calledUpdatedEndpoint = true;
           return res(ctx.json(keys));
         }),
       );
@@ -288,8 +290,7 @@ describe('IdentityClient', () => {
       const token = await factory.issueToken({ claims: { sub: 'foo2' } });
       const response = await client.authenticate(token);
       // Verify that the endpoint was updated.
-      const url = (client as any).endpoint as URL;
-      expect(url.toString()).toMatch(`${updatedURL}/.well-known/jwks.json`);
+      expect(calledUpdatedEndpoint).toBeTruthy();
       expect(response).toEqual({
         token: token,
         identity: {
@@ -304,11 +305,4 @@ describe('IdentityClient', () => {
       dateSpy.mockClear();
     });
   });
-
-  describe('listPublicKeys', () => {
-    it('should use the correct endpoint', async () => {
-      const url = (client as any).endpoint as URL;
-      expect(url.toString()).toMatch(`${mockBaseUrl}/.well-known/jwks.json`);
-    });
-  });
 });
diff --git a/plugins/auth-node/src/IdentityClient.ts b/plugins/auth-node/src/IdentityClient.ts
index cfe802d184..605c434431 100644
--- a/plugins/auth-node/src/IdentityClient.ts
+++ b/plugins/auth-node/src/IdentityClient.ts
@@ -40,7 +40,6 @@ export class IdentityClient {
   private readonly discovery: PluginEndpointDiscovery;
   private readonly issuer: string;
   private keyStore?: GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput>;
-  private endpoint?: URL;
   private keyStoreUpdated: number = 0;
 
   /**
@@ -59,11 +58,6 @@ export class IdentityClient {
   }) {
     this.discovery = options.discovery;
     this.issuer = options.issuer;
-    this.discovery.getBaseUrl('auth').then(url => {
-      this.endpoint = new URL(`${url}/.well-known/jwks.json`);
-      this.keyStore = createRemoteJWKSet(this.endpoint);
-      this.keyStoreUpdated = Date.now() / 1000;
-    });
   }
 
   /**
@@ -82,11 +76,11 @@ export class IdentityClient {
     // Verify token claims and signature
     // Note: Claims must match those set by TokenFactory when issuing tokens
     // Note: verify throws if verification fails
+    // Check if the keystore needs to be updated
+    await this.refreshKeyStore(token);
     if (!this.keyStore) {
       throw new AuthenticationError('No keystore exists');
     }
-    // Check if the keystore needs to be updated
-    await this.refreshKeyStore(token);
     const decoded = await jwtVerify(token, this.keyStore, {
       algorithms: ['ES256'],
       audience: 'backstage',
@@ -139,8 +133,7 @@ export class IdentityClient {
     if (!keyStoreHasKey && issuedAfterLastRefresh) {
       const url = await this.discovery.getBaseUrl('auth');
       const endpoint = new URL(`${url}/.well-known/jwks.json`);
-      this.endpoint = endpoint;
-      this.keyStore = createRemoteJWKSet(this.endpoint);
+      this.keyStore = createRemoteJWKSet(endpoint);
       this.keyStoreUpdated = Date.now() / 1000;
     }
   }