diff --git a/integration/autoupdate/tools/updater_test.go b/integration/autoupdate/tools/updater_test.go
index 0ef2eabb4aa41..0491a63ac272a 100644
--- a/integration/autoupdate/tools/updater_test.go
+++ b/integration/autoupdate/tools/updater_test.go
@@ -66,8 +66,10 @@ func TestUpdate(t *testing.T) {
 
 	// Verify that the installed version is equal to requested one.
 	cmd := exec.CommandContext(ctx, tctlPath, "version")
+	var stderr bytes.Buffer
+	cmd.Stderr = &stderr
 	out, err := cmd.Output()
-	require.NoError(t, err)
+	require.NoError(t, err, stderr.String())
 
 	matches := pattern.FindStringSubmatch(string(out))
 	require.Len(t, matches, 2)
diff --git a/tool/tctl/common/client/auth.go b/tool/tctl/common/client/auth.go
index 1a5ea200c713b..2ba1a5b67d239 100644
--- a/tool/tctl/common/client/auth.go
+++ b/tool/tctl/common/client/auth.go
@@ -35,10 +35,8 @@ import (
 	libmfa "github.com/gravitational/teleport/lib/client/mfa"
 	"github.com/gravitational/teleport/lib/client/sso"
 	"github.com/gravitational/teleport/lib/reversetunnelclient"
-	"github.com/gravitational/teleport/lib/service/servicecfg"
 	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/tool/common"
-	tctlcfg "github.com/gravitational/teleport/tool/tctl/common/config"
 )
 
 // InitFunc initiates connection to auth service, makes ping request and return the client instance.
@@ -47,13 +45,8 @@ import (
 type InitFunc func(ctx context.Context) (client *authclient.Client, close func(context.Context), err error)
 
 // GetInitFunc wraps lazy loading auth init function for commands which requires the auth client.
-func GetInitFunc(ccf tctlcfg.GlobalCLIFlags, cfg *servicecfg.Config) InitFunc {
+func GetInitFunc(clientConfig *authclient.Config) InitFunc {
 	return func(ctx context.Context) (*authclient.Client, func(context.Context), error) {
-		clientConfig, err := tctlcfg.ApplyConfig(&ccf, cfg)
-		if err != nil {
-			return nil, nil, trace.Wrap(err)
-		}
-
 		resolver, err := reversetunnelclient.CachingResolver(
 			ctx,
 			reversetunnelclient.WebClientResolver(&webclient.Config{
@@ -70,7 +63,7 @@ func GetInitFunc(ccf tctlcfg.GlobalCLIFlags, cfg *servicecfg.Config) InitFunc {
 		dialer, err := reversetunnelclient.NewTunnelAuthDialer(reversetunnelclient.TunnelAuthDialerConfig{
 			Resolver:              resolver,
 			ClientConfig:          clientConfig.SSH,
-			Log:                   cfg.Logger,
+			Log:                   clientConfig.Log,
 			InsecureSkipTLSVerify: clientConfig.Insecure,
 			GetClusterCAs:         apiclient.ClusterCAsFromCertPool(clientConfig.TLS.RootCAs),
 		})
@@ -87,7 +80,7 @@ func GetInitFunc(ccf tctlcfg.GlobalCLIFlags, cfg *servicecfg.Config) InitFunc {
 			}
 			fmt.Fprintf(os.Stderr,
 				"ERROR: Cannot connect to the auth server. Is the auth server running on %q?\n",
-				cfg.AuthServerAddresses()[0].Addr)
+				clientConfig.AuthServers[0].Addr)
 			return nil, nil, trace.NewAggregate(&common.ExitCodeError{Code: 1}, err)
 		}
 
diff --git a/tool/tctl/common/tctl.go b/tool/tctl/common/tctl.go
index a8f671c5ad37e..62e82e12e3b11 100644
--- a/tool/tctl/common/tctl.go
+++ b/tool/tctl/common/tctl.go
@@ -181,7 +181,13 @@ func TryRun(ctx context.Context, commands []CLICommand, args []string) error {
 
 	cfg.Debug = ccf.Debug
 
-	clientFunc := commonclient.GetInitFunc(ccf, cfg)
+	clientConfig, err := tctlcfg.ApplyConfig(&ccf, cfg)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+
+	clientFunc := commonclient.GetInitFunc(clientConfig)
+
 	// Execute whatever is selected.
 	for _, c := range commands {
 		match, err := c.TryRun(ctx, selectedCmd, clientFunc)