diff --git a/nix/vm-tests/full-setup.py b/nix/vm-tests/full-setup.py
index 8a30f94f6..7d305a368 100644
--- a/nix/vm-tests/full-setup.py
+++ b/nix/vm-tests/full-setup.py
@@ -49,10 +49,14 @@ def diagnose(unit=None, container=None):
     where = f"--machine={container} " if container else ""
     units = [unit] if isinstance(unit, str) else list(unit or [])
     flags = " ".join(f"-u '{u}'" for u in units)
+    names = " ".join(f"'{u}'" for u in units)
     for command in [
         f"systemctl {where}--failed --no-legend --no-pager",
         *(
-            [f"journalctl {where}{flags} --no-pager -n 50 | tail -c 6000"]
+            [
+                f"systemctl {where}status {names} --no-pager -l",
+                f"journalctl {where}{flags} --no-pager -n 50 | tail -c 6000",
+            ]
             if units
             else []
         ),
@@ -81,6 +85,11 @@ def create_agent(body):
             return
         machine.sleep(10)
     diagnose("swarm-controller")
+    # The queue refuses every client when its responder cannot answer. nats and
+    # the responder run in the container; the units that fetch its keys and
+    # certificate run on the host.
+    diagnose(["nats.service", "swarm-nats-auth.service"], "swarm-nats")
+    diagnose(["swarm-bao-nats-tls.service", "swarm-bao-nats-callout-xkey.service"])
     raise Exception(
         f"the controller refused to create {body['name']}: HTTP {out}: {machine.succeed('cat /root/create.out')}"
     )