diff --git a/internal/auth/jwt.go b/internal/auth/jwt.go
index 4709e9ea..4fbc6523 100644
--- a/internal/auth/jwt.go
+++ b/internal/auth/jwt.go
@@ -102,18 +102,18 @@ func (ja *JWTAuthenticator) AuthViaJWT(
 
 	token, err := jwt.Parse(rawtoken, func(t *jwt.Token) (any, error) {
 		if t.Method != jwt.SigningMethodEdDSA {
-			return nil, errors.New("only Ed25519/EdDSA supported")
+			return nil, errors.New("JWT Auth: only Ed25519/EdDSA supported")
 		}
 
 		return ja.publicKey, nil
 	})
 	if err != nil {
-		cclog.Warn("Error while parsing JWT token")
+		cclog.Warnf("JWT Auth: error while parsing token: %s", err.Error())
 		return nil, err
 	}
 	if !token.Valid {
-		cclog.Warn("jwt token claims are not valid")
-		return nil, errors.New("jwt token claims are not valid")
+		cclog.Warn("JWT Auth: token claims are not valid")
+		return nil, errors.New("JWT Auth: token claims are not valid")
 	}
 
 	// Token is valid, extract payload
diff --git a/internal/auth/jwtCookieSession.go b/internal/auth/jwtCookieSession.go
index 602a267f..ea126f21 100644
--- a/internal/auth/jwtCookieSession.go
+++ b/internal/auth/jwtCookieSession.go
@@ -124,7 +124,7 @@ func (ja *JWTCookieSessionAuthenticator) Login(
 
 	unverified, _, perr := parser.ParseUnverified(rawtoken, jwt.MapClaims{})
 	if perr != nil {
-		cclog.Warn("JWT cookie session: error while parsing token")
+		cclog.Warnf("JWT cookie session: error while parsing unverified token: %s", err.Error())
 		return nil, perr
 	}
 	issuer, _ := unverified.Claims.(jwt.MapClaims)["iss"].(string)
@@ -136,18 +136,18 @@ func (ja *JWTCookieSessionAuthenticator) Login(
 	case "":
 		key = ja.publicKey
 	default:
-		return nil, fmt.Errorf("untrusted JWT issuer: %q", issuer)
+		return nil, fmt.Errorf("JWT cookie session: untrusted issuer: %q", issuer)
 	}
 
 	token, err := parser.Parse(rawtoken, func(*jwt.Token) (any, error) { return key, nil })
 	if err != nil {
-		cclog.Warn("JWT cookie session: error while parsing token")
+		cclog.Warnf("JWT cookie session: error while parsing token: %s", err.Error())
 		return nil, err
 	}
 
 	if !token.Valid {
-		cclog.Warn("jwt token claims are not valid")
-		return nil, errors.New("jwt token claims are not valid")
+		cclog.Warn("JWT cookie session: token claims are not valid")
+		return nil, errors.New("JWT cookie session: token claims are not valid")
 	}
 
 	claims := token.Claims.(jwt.MapClaims)
diff --git a/internal/auth/jwtSession.go b/internal/auth/jwtSession.go
index 6b464548..3ad2adc2 100644
--- a/internal/auth/jwtSession.go
+++ b/internal/auth/jwtSession.go
@@ -69,20 +69,20 @@ func (ja *JWTSessionAuthenticator) Login(
 			// Init() already refuses to register without a key, so this should
 			// never trigger, but guard explicitly rather than trust the chain.
 			if len(ja.loginTokenKey) == 0 {
-				return nil, errors.New("HS login key not configured")
+				return nil, errors.New("JWT Session: HS login key not configured")
 			}
 			return ja.loginTokenKey, nil
 		}
-		return nil, fmt.Errorf("unkown signing method for login token: %s (known: HS256, HS512, EdDSA)", t.Method.Alg())
+		return nil, fmt.Errorf("JWT Session: unkown signing method for login token: %s (known: HS256, HS512, EdDSA)", t.Method.Alg())
 	})
 	if err != nil {
-		cclog.Warn("Error while parsing jwt token")
+		cclog.Warnf("JWT Session: error while parsing token: %s", err.Error())
 		return nil, err
 	}
 
 	if !token.Valid {
-		cclog.Warn("jwt token claims are not valid")
-		return nil, errors.New("jwt token claims are not valid")
+		cclog.Warn("JWT Session: token claims are not valid")
+		return nil, errors.New("JWT Session: token claims are not valid")
 	}
 
 	claims := token.Claims.(jwt.MapClaims)