diff --git a/managed/services/server/updater.go b/managed/services/server/updater.go
index 5f1a30fdc6..9c6bc12f33 100644
--- a/managed/services/server/updater.go
+++ b/managed/services/server/updater.go
@@ -133,6 +133,13 @@ func (up *Updater) sendRequestToWatchtower(ctx context.Context, newImageName str
 	}
 	defer resp.Body.Close() //nolint:errcheck
 
+	if resp.StatusCode == http.StatusBadRequest {
+		bytes, err := io.ReadAll(resp.Body)
+		if err != nil {
+			return errors.Wrap(err, "failed to read response body")
+		}
+		return grpcstatus.Error(codes.FailedPrecondition, string(bytes))
+	}
 	// Check the response
 	if resp.StatusCode != http.StatusOK {
 		return errors.Errorf("received non-OK response: %v", resp.StatusCode)
@@ -151,22 +158,25 @@ func (up *Updater) StartUpdate(ctx context.Context, newImageName string) error {
 	up.performM.Lock()
 	defer up.performM.Unlock()
 	if up.running {
-		return errors.New("update already in progress")
+		return grpcstatus.Error(codes.FailedPrecondition, "update already in progress")
 	}
 	up.running = true
 	if newImageName == "" {
+		up.running = false
 		return errors.New("newImageName is empty")
 	}
 
 	err := up.checkWatchtowerHost()
 	if err != nil {
+		up.running = false
 		up.l.WithError(err).Error("Failed to check watchtower host")
 		return grpcstatus.Errorf(codes.FailedPrecondition, "failed to check watchtower host")
 	}
 
 	if err := up.sendRequestToWatchtower(ctx, newImageName); err != nil {
+		up.running = false
 		up.l.WithError(err).Error("Failed to trigger update")
-		return errors.Wrap(err, "failed to trigger update")
+		return err
 	}
 	return nil
 }