diff --git a/pkg/workloadmanager/handlers.go b/pkg/workloadmanager/handlers.go
index f767dfa1..589c1e39 100644
--- a/pkg/workloadmanager/handlers.go
+++ b/pkg/workloadmanager/handlers.go
@@ -79,6 +79,17 @@ func (s *Server) extractUserK8sClient(c *gin.Context) (dynamic.Interface, error)
 	return userClient.dynamicClient, nil
 }
 
+func respondSandboxBuildError(c *gin.Context, err error) {
+	switch {
+	case errors.Is(err, api.ErrAgentRuntimeNotFound), errors.Is(err, api.ErrCodeInterpreterNotFound):
+		respondError(c, http.StatusNotFound, err.Error())
+	case errors.Is(err, api.ErrPublicKeyMissing):
+		respondError(c, http.StatusServiceUnavailable, err.Error())
+	default:
+		respondError(c, http.StatusInternalServerError, "internal server error")
+	}
+}
+
 // handleSandboxCreate handles sandbox creation given a specific kind.
 func (s *Server) handleSandboxCreate(c *gin.Context, kind string) {
 	sandboxReq := &types.CreateSandboxRequest{}
@@ -109,11 +120,7 @@ func (s *Server) handleSandboxCreate(c *gin.Context, kind string) {
 
 	if err != nil {
 		klog.Errorf("build sandbox failed %s/%s: %v", sandboxReq.Namespace, sandboxReq.Name, err)
-		if errors.Is(err, api.ErrAgentRuntimeNotFound) || errors.Is(err, api.ErrCodeInterpreterNotFound) {
-			respondError(c, http.StatusNotFound, err.Error())
-		} else {
-			respondError(c, http.StatusInternalServerError, "internal server error")
-		}
+		respondSandboxBuildError(c, err)
 		return
 	}
 
diff --git a/pkg/workloadmanager/handlers_test.go b/pkg/workloadmanager/handlers_test.go
index 30336c09..7cef5850 100644
--- a/pkg/workloadmanager/handlers_test.go
+++ b/pkg/workloadmanager/handlers_test.go
@@ -334,6 +334,14 @@ func TestHandleSandboxCreate(t *testing.T) {
 			expectStatus:  http.StatusNotFound,
 			expectMessage: api.ErrAgentRuntimeNotFound.Error(),
 		},
+		{
+			name:          "public key missing returns service unavailable",
+			kind:          types.CodeInterpreterKind,
+			body:          `{"name":"workload","namespace":"ns"}`,
+			buildErr:      api.ErrPublicKeyMissing,
+			expectStatus:  http.StatusServiceUnavailable,
+			expectMessage: api.ErrPublicKeyMissing.Error(),
+		},
 		{
 			name:          "build sandbox internal error",
 			kind:          types.AgentRuntimeKind,