diff --git a/internal/carrier/builtin/engine_adapter.go b/internal/carrier/builtin/engine_adapter.go
index 09bdb69..981d72d 100644
--- a/internal/carrier/builtin/engine_adapter.go
+++ b/internal/carrier/builtin/engine_adapter.go
@@ -2,6 +2,7 @@ package builtin
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
 	"github.com/openlibrecommunity/olcrtc/internal/auth"
@@ -49,7 +50,7 @@ func registerEngineAuth(carrierName string, authProvider auth.Provider) {
 		}
 		creds, err := authProvider.Issue(ctx, authCfg)
 		if err != nil {
-			return nil, fmt.Errorf("auth issue: %w", err)
+			return nil, fmt.Errorf("auth issue: %w", errors.Join(carrier.ErrAuthFailed, err))
 		}
 
 		sess, err := engine.New(ctx, authProvider.Engine(), engine.Config{
diff --git a/internal/carrier/carrier.go b/internal/carrier/carrier.go
index cf57987..cf5e7c8 100644
--- a/internal/carrier/carrier.go
+++ b/internal/carrier/carrier.go
@@ -13,6 +13,8 @@ var (
 	ErrByteStreamUnsupported = errors.New("carrier does not support byte stream")
 	// ErrVideoTrackUnsupported is returned when a carrier cannot exchange video tracks.
 	ErrVideoTrackUnsupported = errors.New("carrier does not support video tracks")
+	// ErrAuthFailed is returned when a carrier's auth provider rejects the request.
+	ErrAuthFailed = errors.New("carrier auth failed")
 )
 
 // Capabilities describes the transport primitives a carrier can expose.
diff --git a/internal/e2e/tunnel_test.go b/internal/e2e/tunnel_test.go
index 37ef84c..4415ab4 100644
--- a/internal/e2e/tunnel_test.go
+++ b/internal/e2e/tunnel_test.go
@@ -1017,11 +1017,19 @@ func TestRealProviderTransportMatrix(t *testing.T) {
 			roomCtx, cancelRoom := context.WithTimeout(context.Background(), *realE2ETimeout)
 			defer cancelRoom()
 			roomURL := requireRealRoom(roomCtx, t, carrierName)
+			var authFailed bool
 			for _, transportName := range transports {
 				t.Run(transportName, func(t *testing.T) {
+					if authFailed {
+						t.Skip("skipping: carrier auth failed on previous transport")
+					}
 					expectation := realE2ECaseExpectation(carrierName, transportName)
 					label := realE2EExpectationLabel(expectation)
 					err := runRealE2ECase(t, carrierName, transportName, roomURL, echoAddr)
+					if err != nil && errors.Is(err, carrier.ErrAuthFailed) {
+						authFailed = true
+						t.Skipf("skip %s real e2e: auth failed: %v", carrierName, err)
+					}
 					switch {
 					case err == nil && expectation == realE2EExpectPass:
 						t.Logf("%s %s/%s", label, carrierName, transportName)