diff --git a/nix/agent-modules/hive-ca.nix b/nix/agent-modules/hive-ca.nix
index 47d875b0..94effef1 100644
--- a/nix/agent-modules/hive-ca.nix
+++ b/nix/agent-modules/hive-ca.nix
@@ -130,6 +130,9 @@ in
           cacert=
           if [ -s "$CREDENTIALS_DIRECTORY/${serverCaCredential}" ]; then
             cacert="$CREDENTIALS_DIRECTORY/${serverCaCredential}"
+            echo "trusting bao via the delivered server CA credential" >&2
+          else
+            echo "no bao server CA credential delivered; trusting the system bundle" >&2
           fi
 
           dir=/run/${runtimeDir}