diff --git a/pkg/cache/client/round_tripper.go b/pkg/cache/client/round_tripper.go
index dbe6a164f89..2cd9ceb6ea2 100644
--- a/pkg/cache/client/round_tripper.go
+++ b/pkg/cache/client/round_tripper.go
@@ -87,6 +87,10 @@ func (c *ShardRoundTripper) RoundTrip(req *http.Request) (*http.Response, error)
 	return c.delegate.RoundTrip(req)
 }
 
+func (c *ShardRoundTripper) WrappedRoundTripper() http.RoundTripper {
+	return c.delegate
+}
+
 // generatePath formats the request path to target the specified shard.
 func generatePath(originalPath string, shard clientshard.Name) (string, error) {
 	// if the originalPath already has the shard then the path was already modified and no change needed
@@ -151,6 +155,10 @@ func (c *DefaultShardRoundTripper) RoundTrip(req *http.Request) (*http.Response,
 	return c.delegate.RoundTrip(req)
 }
 
+func (c *DefaultShardRoundTripper) WrappedRoundTripper() http.RoundTripper {
+	return c.delegate
+}
+
 // WithShardNameFromObjectRoundTripper wraps an existing config with ShardNameFromObjectRoundTripper.
 //
 // Note: it is the caller responsibility to make a copy of the rest config.
@@ -221,6 +229,10 @@ func (c *ShardNameFromObjectRoundTripper) RoundTrip(req *http.Request) (*http.Re
 	return c.delegate.RoundTrip(req)
 }
 
+func (c *ShardNameFromObjectRoundTripper) WrappedRoundTripper() http.RoundTripper {
+	return c.delegate
+}
+
 // WithCacheServiceRoundTripper wraps an existing config's with CacheServiceRoundTripper.
 func WithCacheServiceRoundTripper(cfg *rest.Config) *rest.Config {
 	cfg.Wrap(func(rt http.RoundTripper) http.RoundTripper {
@@ -260,3 +272,7 @@ func (c *CacheServiceRoundTripper) RoundTrip(req *http.Request) (*http.Response,
 	}
 	return c.delegate.RoundTrip(req)
 }
+
+func (c *CacheServiceRoundTripper) WrappedRoundTripper() http.RoundTripper {
+	return c.delegate
+}
diff --git a/pkg/metadata/dynamic.go b/pkg/metadata/dynamic.go
index 523f284cec5..22c22a6e3f2 100644
--- a/pkg/metadata/dynamic.go
+++ b/pkg/metadata/dynamic.go
@@ -71,6 +71,10 @@ func (t *metadataTransport) RoundTrip(req *http.Request) (*http.Response, error)
 	return t.RoundTripper.RoundTrip(req)
 }
 
+func (t *metadataTransport) WrappedRoundTripper() http.RoundTripper {
+	return t.RoundTripper
+}
+
 func partialType(req *http.Request) (string, error) {
 	// strip off /clusters/<lcluster>
 	baseReq := *req
diff --git a/pkg/server/bootstrap/identity.go b/pkg/server/bootstrap/identity.go
index 08bec1fb33d..4c1e82711b6 100644
--- a/pkg/server/bootstrap/identity.go
+++ b/pkg/server/bootstrap/identity.go
@@ -226,33 +226,43 @@ func apiExportIdentityProvider(config *rest.Config, localShardKubeClusterClient
 	}
 }
 
-type roundTripperFunc func(*http.Request) (*http.Response, error)
+type roundTripperFunc struct {
+	delegate http.RoundTripper
+	fn       func(*http.Request) (*http.Response, error)
+}
 
-var _ http.RoundTripper = roundTripperFunc(nil)
+var _ http.RoundTripper = roundTripperFunc{}
 
 func (rt roundTripperFunc) RoundTrip(r *http.Request) (*http.Response, error) {
-	return rt(r)
+	return rt.fn(r)
+}
+
+func (rt roundTripperFunc) WrappedRoundTripper() http.RoundTripper {
+	return rt.delegate
 }
 
 // injectKcpIdentities injects the KCP identities into the request URLs.
 func injectKcpIdentities(ids *identities) func(rt http.RoundTripper) http.RoundTripper {
 	return func(rt http.RoundTripper) http.RoundTripper {
-		return roundTripperFunc(func(origReq *http.Request) (*http.Response, error) {
-			urlPath, err := decorateWildcardPathsWithResourceIdentities(origReq.URL.Path, ids)
-			if err != nil {
-				return nil, err
-			}
-			if urlPath == origReq.URL.Path {
-				return rt.RoundTrip(origReq)
-			}
+		return roundTripperFunc{
+			delegate: rt,
+			fn: func(origReq *http.Request) (*http.Response, error) {
+				urlPath, err := decorateWildcardPathsWithResourceIdentities(origReq.URL.Path, ids)
+				if err != nil {
+					return nil, err
+				}
+				if urlPath == origReq.URL.Path {
+					return rt.RoundTrip(origReq)
+				}
 
-			req := *origReq // shallow copy
-			req.URL = &url.URL{}
-			*req.URL = *origReq.URL
-			req.URL.Path = urlPath
+				req := *origReq // shallow copy
+				req.URL = &url.URL{}
+				*req.URL = *origReq.URL
+				req.URL.Path = urlPath
 
-			return rt.RoundTrip(&req)
-		})
+				return rt.RoundTrip(&req)
+			},
+		}
 	}
 }