diff --git a/spindle/engines/microvm/engine.go b/spindle/engines/microvm/engine.go
index b2cd7c57..4271ffbd 100644
--- a/spindle/engines/microvm/engine.go
+++ b/spindle/engines/microvm/engine.go
@@ -613,10 +613,22 @@ func (e *Engine) classifyStepError(
 		return engine.ClassifiedFailure(class, failureReason, fmt.Errorf("%s:\n%w", category, errors.New(reason+"; see workflow logs for serial output")))
 	}
 
-	if errors.Is(err, errGuestTimedOut) || ctx.Err() != nil {
+	cause := context.Cause(ctx)
+	if errors.Is(cause, engine.ErrWorkflowCanceled) {
+		l.Info("step canceled")
+		return engine.ErrWorkflowCanceled
+	}
+	if errors.Is(err, errGuestTimedOut) || errors.Is(cause, context.DeadlineExceeded) {
 		l.Debug("step timed out", "guestReported", errors.Is(err, errGuestTimedOut))
 		return engine.ErrTimedOut
 	}
+	if ctx.Err() != nil {
+		return engine.ClassifiedFailure(
+			engine.FailureClassInfrastructure,
+			engine.FailureReasonRuntimeFailed,
+			fmt.Errorf("step context canceled: %w", ctx.Err()),
+		)
+	}
 
 	// the agent connection dropped while qemu stayed up (eg. the guest kernel
 	// OOM-killed the agent or a guest panic), so surface serial logs, those