diff --git a/cmd/pinniped/cmd/flag_types.go b/cmd/pinniped/cmd/flag_types.go
index 8ca97681..ad682a1d 100644
--- a/cmd/pinniped/cmd/flag_types.go
+++ b/cmd/pinniped/cmd/flag_types.go
@@ -25,7 +25,7 @@ func (c *conciergeMode) String() string {
 	switch *c {
 	case modeImpersonationProxy:
 		return "ImpersonationProxy"
-	case modeTokenCredentialRequestAPI:
+	case modeTokenCredentialRequestAPI, modeUnknown:
 		return "TokenCredentialRequestAPI"
 	default:
 		return "TokenCredentialRequestAPI"
diff --git a/cmd/pinniped/cmd/kubeconfig.go b/cmd/pinniped/cmd/kubeconfig.go
index 7bdcff64..5dfe87b1 100644
--- a/cmd/pinniped/cmd/kubeconfig.go
+++ b/cmd/pinniped/cmd/kubeconfig.go
@@ -251,14 +251,14 @@ func configureConcierge(credentialIssuer *configv1alpha1.CredentialIssuer, authe
 
 	// Autodiscover the --concierge-mode.
 	if flags.concierge.mode == modeUnknown {
-
-		if credentialIssuer.Status.KubeConfigInfo != nil {
+		switch {
+		case credentialIssuer.Status.KubeConfigInfo != nil:
 			// Prefer the TokenCredentialRequest API if available.
 			flags.concierge.mode = modeTokenCredentialRequestAPI
-		} else if credentialIssuer.Status.ImpersonationProxyInfo != nil {
+		case credentialIssuer.Status.ImpersonationProxyInfo != nil:
 			// Otherwise prefer the impersonation proxy if it seems configured.
 			flags.concierge.mode = modeImpersonationProxy
-		} else {
+		default:
 			return fmt.Errorf("could not autodiscover --concierge-mode and none was provided")
 		}
 	}