diff --git a/weed/command/iam.go b/weed/command/iam.go
index c484ed18d..8f4ac878d 100644
--- a/weed/command/iam.go
+++ b/weed/command/iam.go
@@ -76,7 +76,7 @@ func (iamopt *IamOptions) startIamServer() bool {
 
 	masters := pb.ServerAddresses(*iamopt.masters).ToAddressMap()
 	router := mux.NewRouter().SkipClean(true)
-	_, iamApiServer_err := iamapi.NewIamApiServer(router, &iamapi.IamServerOption{
+	iamApiServer, iamApiServer_err := iamapi.NewIamApiServer(router, &iamapi.IamServerOption{
 		Masters:        masters,
 		Filer:          filerAddress,
 		Port:           *iamopt.port,
@@ -86,6 +86,9 @@ func (iamopt *IamOptions) startIamServer() bool {
 	if iamApiServer_err != nil {
 		glog.Fatalf("IAM API Server startup error: %v", iamApiServer_err)
 	}
+	
+	// Ensure cleanup on shutdown
+	defer iamApiServer.Shutdown()
 
 	listenAddress := fmt.Sprintf(":%d", *iamopt.port)
 	iamApiListener, iamApiLocalListener, err := util.NewIpAndLocalListeners(*iamopt.ip, *iamopt.port, time.Duration(10)*time.Second)
diff --git a/weed/iamapi/iamapi_server.go b/weed/iamapi/iamapi_server.go
index d7fb1930d..361d9bec9 100644
--- a/weed/iamapi/iamapi_server.go
+++ b/weed/iamapi/iamapi_server.go
@@ -115,8 +115,13 @@ func (iama *IamApiServer) registerRouter(router *mux.Router) {
 // Shutdown gracefully stops the IAM API server and releases resources.
 // It cancels the master client connection goroutine and closes gRPC connections.
 // This method is safe to call multiple times.
+//
+// Note: This method is called via defer in weed/command/iam.go for best-effort cleanup.
+// For proper graceful shutdown on SIGTERM/SIGINT, signal handling should be added to
+// the command layer to call this method before process exit.
 func (iama *IamApiServer) Shutdown() {
 	if iama.shutdownCancel != nil {
+		glog.V(0).Infof("IAM API server shutting down, stopping master client connection")
 		iama.shutdownCancel()
 	}
 }