diff --git a/lambdas/po/web_ui/handler.py b/lambdas/po/web_ui/handler.py
index 9e8d48f..e229a0d 100644
--- a/lambdas/po/web_ui/handler.py
+++ b/lambdas/po/web_ui/handler.py
@@ -7,6 +7,7 @@ Accessed via Lambda Function URL.
 
 import hmac
 import json
+import logging
 import os
 import time
 from decimal import Decimal
@@ -14,6 +15,9 @@ from html import escape as esc
 
 import boto3
 
+logger = logging.getLogger()
+logger.setLevel(logging.INFO)
+
 dynamodb = boto3.resource("dynamodb")
 
 PO_TABLE = os.environ.get("PO_TABLE", "purchase-orders")
@@ -58,6 +62,14 @@ def _get_auth_token() -> str | None:
         _auth_token_cached_at = now
         return _auth_token_cache
     except Exception:
+        # Fail closed (return None -> caller 401s) but surface the failure: a
+        # Secrets Manager permission/config error would otherwise make every
+        # request 401 with no operational signal. The secret value is never
+        # logged.
+        logger.exception(
+            "Failed to fetch web UI auth token from Secrets Manager; "
+            "denying request (failing closed)"
+        )
         return None
 
 
diff --git a/lambdas/wo/web_ui/handler.py b/lambdas/wo/web_ui/handler.py
index 21f64aa..3e3c849 100644
--- a/lambdas/wo/web_ui/handler.py
+++ b/lambdas/wo/web_ui/handler.py
@@ -7,12 +7,16 @@ Accessed via Lambda Function URL.
 
 import hmac
 import json
+import logging
 import os
 import time
 from html import escape as esc
 
 import boto3
 
+logger = logging.getLogger()
+logger.setLevel(logging.INFO)
+
 dynamodb = boto3.resource("dynamodb")
 
 WORK_ORDERS_TABLE = os.environ.get("WORK_ORDERS_TABLE", "WorkOrders")
@@ -57,6 +61,14 @@ def _get_auth_token() -> str | None:
         _auth_token_cached_at = now
         return _auth_token_cache
     except Exception:
+        # Fail closed (return None -> caller 401s) but surface the failure: a
+        # Secrets Manager permission/config error would otherwise make every
+        # request 401 with no operational signal. The secret value is never
+        # logged.
+        logger.exception(
+            "Failed to fetch web UI auth token from Secrets Manager; "
+            "denying request (failing closed)"
+        )
         return None