diff --git a/pkg/registry/apis/provisioning/register.go b/pkg/registry/apis/provisioning/register.go
index 4382302fc18..28a7f0a1c27 100644
--- a/pkg/registry/apis/provisioning/register.go
+++ b/pkg/registry/apis/provisioning/register.go
@@ -648,11 +648,6 @@ func (b *APIBuilder) GetPostStartHooks() (map[string]genericapiserver.PostStartH
 				return err
 			}
 
-			// Informer with resync interval used for health check and reconciliation
-			sharedInformerFactory := informers.NewSharedInformerFactory(c, 60*time.Second)
-			repoInformer := sharedInformerFactory.Provisioning().V0alpha1().Repositories()
-			jobInformer := sharedInformerFactory.Provisioning().V0alpha1().Jobs()
-
 			b.client = c.ProvisioningV0alpha1()
 
 			// Initialize the API client-based job store
@@ -669,6 +664,10 @@ func (b *APIBuilder) GetPostStartHooks() (map[string]genericapiserver.PostStartH
 				return nil
 			}
 
+			// Informer with resync interval used for health check and reconciliation
+			sharedInformerFactory := informers.NewSharedInformerFactory(c, 60*time.Second)
+			repoInformer := sharedInformerFactory.Provisioning().V0alpha1().Repositories()
+			jobInformer := sharedInformerFactory.Provisioning().V0alpha1().Jobs()
 			go repoInformer.Informer().Run(postStartHookCtx.Done())
 			go jobInformer.Informer().Run(postStartHookCtx.Done())
 
diff --git a/pkg/services/apiserver/restconfig.go b/pkg/services/apiserver/restconfig.go
index e3fdbfe7dd9..bc8ea8f32a3 100644
--- a/pkg/services/apiserver/restconfig.go
+++ b/pkg/services/apiserver/restconfig.go
@@ -11,6 +11,9 @@ import (
 )
 
 type RestConfigProvider interface {
+	// GetRestConfig returns a k8s client configuration that is used to provide connection info and auth for the loopback transport.
+	// context is only available for tracing in this immediate function and is not to be confused with the context seen by any client verb actions that are invoked with the retrieved rest config.
+	// - those client verb actions have the ability to specify their own context.
 	GetRestConfig(context.Context) (*clientrest.Config, error)
 }
 
@@ -50,6 +53,7 @@ var (
 // eventualRestConfigProvider is a RestConfigProvider that will not return a rest config until the ready channel is closed.
 // This exists to alleviate a circular dependency between the apiserver.server's dependencies and their dependencies wanting a rest config.
 // Importantly, this is handled by wire as opposed to a mutable global.
+// NOTE: this implementation's GetRestConfig can't be used in (wire-based) Provide functions, or a function called by Provide functions. TODO: determine why that is. @charandas: in one such attempt, the GetRestConfig waits forever and Grafana doesn't start.
 type eventualRestConfigProvider struct {
 	// When this channel is closed, we can start returning the rest config.
 	ready chan struct{}
diff --git a/pkg/services/live/features/watch.go b/pkg/services/live/features/watch.go
index 51e6253ac17..913b6d19e68 100644
--- a/pkg/services/live/features/watch.go
+++ b/pkg/services/live/features/watch.go
@@ -48,7 +48,7 @@ func (b *WatchRunner) GetHandlerForPath(_ string) (model.ChannelHandler, error)
 // Valid paths look like: {version}/{resource}[={name}]/{user.uid}
 // * v0alpha1/dashboards/u12345
 // * v0alpha1/dashboards=ABCD/u12345
-func (b *WatchRunner) OnSubscribe(ctx context.Context, u identity.Requester, e model.SubscribeEvent) (model.SubscribeReply, backend.SubscribeStreamStatus, error) {
+func (b *WatchRunner) OnSubscribe(_ context.Context, u identity.Requester, e model.SubscribeEvent) (model.SubscribeReply, backend.SubscribeStreamStatus, error) {
 	// To make sure we do not share resources across users, in clude the UID in the path
 	userID := u.GetIdentifier()
 	if userID == "" {
@@ -87,11 +87,14 @@ func (b *WatchRunner) OnSubscribe(ctx context.Context, u identity.Requester, e m
 			fmt.Errorf("watching provisioned resources is OK allowed (for now)")
 	}
 
-	requester := types.WithAuthInfo(context.Background(), u)
-	cfg, err := b.configProvider.GetRestConfig(requester)
+	// doesn't matter what GetRestConfig sees for context, matters for watch below
+	cfg, err := b.configProvider.GetRestConfig(context.Background())
 	if err != nil {
 		return model.SubscribeReply{}, backend.SubscribeStreamStatusNotFound, err
 	}
+
+	// add user to both requester and authInfo context keys, older implementations are still using requester
+	ctx := identity.WithRequester(types.WithAuthInfo(context.Background(), u), u)
 	uclient, err := dynamic.NewForConfig(cfg)
 	if err != nil {
 		return model.SubscribeReply{}, backend.SubscribeStreamStatusNotFound, err
@@ -102,7 +105,7 @@ func (b *WatchRunner) OnSubscribe(ctx context.Context, u identity.Requester, e m
 	if len(name) > 1 {
 		opts.FieldSelector = "metadata.name=" + name
 	}
-	watch, err := client.Watch(requester, opts)
+	watch, err := client.Watch(ctx, opts)
 	if err != nil {
 		return model.SubscribeReply{}, backend.SubscribeStreamStatusNotFound, err
 	}