diff --git a/go/adk/pkg/a2a/executor.go b/go/adk/pkg/a2a/executor.go
index ce8faaea2..405999756 100644
--- a/go/adk/pkg/a2a/executor.go
+++ b/go/adk/pkg/a2a/executor.go
@@ -101,7 +101,7 @@ func (u *userIDInterceptor) Before(ctx context.Context, callCtx *a2asrv.CallCont
 	}
 	// Set the authenticated user so downstream code picks up the real identity.
 	callCtx.User = a2asrv.NewAuthenticatedUser(vals[0], nil)
-	return ctx, nil, nil
+	return auth.WithUserID(ctx, vals[0]), nil, nil
 }
 
 // Execute applies kagent-specific request setup and delegates event generation
@@ -114,8 +114,8 @@ func (e *KAgentExecutor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorCon
 		}
 
 		userID := "A2A_USER_" + reqCtx.ContextID
-		if callCtx, ok := a2asrv.CallContextFrom(ctx); ok && callCtx.User != nil && callCtx.User.Name != "" {
-			userID = callCtx.User.Name
+		if id := auth.UserIDFromContext(ctx); id != "" {
+			userID = id
 		}
 		sessionID := reqCtx.ContextID
 
diff --git a/go/adk/pkg/a2a/executor_test.go b/go/adk/pkg/a2a/executor_test.go
index 51574a32b..c21574f2f 100644
--- a/go/adk/pkg/a2a/executor_test.go
+++ b/go/adk/pkg/a2a/executor_test.go
@@ -8,6 +8,7 @@ import (
 	a2atype "github.com/a2aproject/a2a-go/v2/a2a"
 	"github.com/a2aproject/a2a-go/v2/a2asrv"
 	"github.com/go-logr/logr"
+	"github.com/kagent-dev/kagent/go/adk/pkg/auth"
 	adkagent "google.golang.org/adk/v2/agent"
 	"google.golang.org/adk/v2/model"
 	"google.golang.org/adk/v2/runner"
@@ -126,6 +127,24 @@ func TestKAgentExecutor_ForwardsCleanup(t *testing.T) {
 	}
 }
 
+func TestUserIDCallInterceptor_SetsCtxUserID(t *testing.T) {
+	ctx, callCtx := a2asrv.NewCallContext(context.Background(), a2asrv.NewServiceParams(map[string][]string{
+		"x-user-id": {"real-user"},
+	}))
+
+	returned, _, err := UserIDCallInterceptor().Before(ctx, callCtx, &a2asrv.Request{})
+	if err != nil {
+		t.Fatalf("Before() error = %v", err)
+	}
+
+	if got := callCtx.User.Name; got != "real-user" {
+		t.Fatalf("callCtx.User.Name = %q, want %q", got, "real-user")
+	}
+	if got := auth.UserIDFromContext(returned); got != "real-user" {
+		t.Fatalf("auth.UserIDFromContext(returned) = %q, want %q", got, "real-user")
+	}
+}
+
 func TestKAgentExecutor_TranslatesADKPauseAtA2ABoundary(t *testing.T) {
 	reqCtx := &a2asrv.ExecutorContext{
 		TaskID: "task-1", ContextID: "ctx-1",