diff --git a/google/cloud/internal/unified_grpc_credentials.cc b/google/cloud/internal/unified_grpc_credentials.cc
index b1c82e99f2586..ee8005dee59ec 100644
--- a/google/cloud/internal/unified_grpc_credentials.cc
+++ b/google/cloud/internal/unified_grpc_credentials.cc
@@ -121,10 +121,14 @@ std::shared_ptr<GrpcAuthenticationStrategy> CreateAuthenticationStrategy(
       grpc::SslCredentialsOptions ssl_options;
       auto cainfo = LoadCAInfo(options);
       if (cainfo) ssl_options.pem_root_certs = std::move(*cainfo);
-      result = std::make_unique<GrpcChannelCredentialsAuthentication>(
-          grpc::CompositeChannelCredentials(
-              grpc::SslCredentials(ssl_options),
-              GrpcExternalAccountCredentials(cfg)));
+    auto call_creds = GrpcExternalAccountCredentials(cfg);
+     auto channel_creds = grpc::SslCredentials(ssl_options);
+      if (call_creds) {
+        result = std::make_unique<GrpcChannelCredentialsAuthentication>(
+            grpc::CompositeChannelCredentials(channel_creds, call_creds));
+      } else {
+        result = std::make_unique<GrpcChannelCredentialsAuthentication>(channel_creds);
+      }
     }
     void visit(ApiKeyConfig const& cfg) override {
       result = std::make_unique<GrpcApiKeyAuthentication>(cfg.api_key());