diff --git a/src/server/middleware/trustedAuth.ts b/src/server/middleware/trustedAuth.ts
index 4bbf4910..4696636a 100644
--- a/src/server/middleware/trustedAuth.ts
+++ b/src/server/middleware/trustedAuth.ts
@@ -63,6 +63,10 @@ export default defineEventHandler(async (event) => {
   // 1a. Trust gate — the proxy-injected shared secret must match (constant time).
   const providedSecret = getHeader(event, WG_ENV.TRUSTED_PROXY_SECRET_HEADER);
   if (!secretMatches(providedSecret, WG_ENV.TRUSTED_PROXY_SECRET)) {
+    SERVER_DEBUG(
+      `Trusted-header SSO: secret check failed for ${url.pathname} ` +
+        `(header '${WG_ENV.TRUSTED_PROXY_SECRET_HEADER}' present=${!!providedSecret})`
+    );
     return;
   }
 
@@ -71,6 +75,7 @@ export default defineEventHandler(async (event) => {
   if (WG_ENV.TRUSTED_PROXY_IPS.length > 0) {
     const peer = getRequestIP(event, { xForwardedFor: false });
     if (!peer || !WG_ENV.TRUSTED_PROXY_IPS.includes(peer)) {
+      SERVER_DEBUG(`Trusted-header SSO: peer ${peer} not in allowlist`);
       return;
     }
   }
@@ -78,6 +83,10 @@ export default defineEventHandler(async (event) => {
   // 2. Read the identity the upstream verified.
   const username = getHeader(event, WG_ENV.TRUSTED_PROXY_HEADER)?.trim();
   if (!username) {
+    SERVER_DEBUG(
+      `Trusted-header SSO: secret OK but no username header ` +
+        `('${WG_ENV.TRUSTED_PROXY_HEADER}') on ${url.pathname}`
+    );
     return;
   }