diff --git a/cmd/auth/token.go b/cmd/auth/token.go
index e7c004d7b4c..bbde8dc5eff 100644
--- a/cmd/auth/token.go
+++ b/cmd/auth/token.go
@@ -452,15 +452,18 @@ func runInlineLogin(ctx context.Context, profiler profile.Profiler, tokenStore s
 		u2m.WithOAuthArgument(oauthArgument),
 		u2m.WithBrowser(func(url string) error { return browser.Open(ctx, url) }),
 	}
+
+	// Challenge uses the context passed to NewPersistentAuth, so the timeout
+	// must be set before it.
+	ctx, cancel := context.WithTimeout(ctx, defaultTimeout)
+	defer cancel()
+
 	persistentAuth, err := u2m.NewPersistentAuth(ctx, persistentAuthOpts...)
 	if err != nil {
 		return "", nil, err
 	}
 	defer persistentAuth.Close()
 
-	ctx, cancel := context.WithTimeout(ctx, defaultTimeout)
-	defer cancel()
-
 	token, err := persistentAuth.Challenge()
 	if err != nil {
 		return "", nil, err