diff --git a/blob/gcsblob/gcsblob.go b/blob/gcsblob/gcsblob.go
index f8e61827c1..452edd39cc 100644
--- a/blob/gcsblob/gcsblob.go
+++ b/blob/gcsblob/gcsblob.go
@@ -163,7 +163,7 @@ func (o *lazyCredsOpener) OpenBucketURL(ctx context.Context, u *url.URL) (*blob.
 				fmt.Printf("Warning: unable to load GCP Default Credentials: %v", err)
 				// Use empty credentials, in case the user isn't going to actually use
 				// them; e.g., getting signed URLs with GoogleAccessID=-.
-				creds = &google.Credentials{}
+				creds, _ = google.CredentialsFromJSON(ctx, []byte(`{"type": "service_account"}`))
 			}
 
 			// Populate default values from credentials files, where available.