diff --git a/agent/engine/task_manager.go b/agent/engine/task_manager.go
index c69273decba..46d1f21dc44 100644
--- a/agent/engine/task_manager.go
+++ b/agent/engine/task_manager.go
@@ -1454,12 +1454,6 @@ func (mtask *managedTask) cleanupTask(taskStoppedDuration time.Duration) {
 		return
 	}
 
-	// Remove TaskExecutionCredentials from credentialsManager
-	if taskExecutionCredentialsID != "" {
-		logger.Info("Cleaning up task's execution credentials")
-		mtask.credentialsManager.RemoveCredentials(taskExecutionCredentialsID)
-	}
-
 	logger.Info("Cleaning up task's containers and data", logger.Fields{
 		field.TaskARN: mtask.Arn,
 	})
@@ -1471,6 +1465,12 @@ func (mtask *managedTask) cleanupTask(taskStoppedDuration time.Duration) {
 	mtask.engine.sweepTask(mtask.Task)
 	mtask.engine.deleteTask(mtask.Task)
 
+	// Remove TaskExecutionCredentials from credentialsManager
+	if taskExecutionCredentialsID != "" {
+		logger.Info("Cleaning up task's execution credentials")
+		mtask.credentialsManager.RemoveCredentials(taskExecutionCredentialsID)
+	}
+
 	// The last thing to do here is to cancel the context, which should cancel
 	// all outstanding go routines associated with this managed task.
 	mtask.cancel()
diff --git a/misc/certs/Dockerfile b/misc/certs/Dockerfile
index 47afb2e99f4..e5d10de2dad 100644
--- a/misc/certs/Dockerfile
+++ b/misc/certs/Dockerfile
@@ -1,4 +1,4 @@
-FROM debian:stable-20201012
+FROM debian:stable-20210816
 
 RUN apt-get update &&  \
     apt-get install -y ca-certificates && \
diff --git a/scripts/ci-ecr b/scripts/ci-ecr
index 04999e8221b..0891d0cd39c 100644
--- a/scripts/ci-ecr
+++ b/scripts/ci-ecr
@@ -7,5 +7,5 @@ golang:$GO_VERSION
 golang:$GO_VERSION_WINDOWS
 gcc:7.3.0
 busybox:1.32.0
-debian:stable-20201012
+debian:stable-20210816
 fluent/fluentd:v1.11.5-1.0"