diff --git a/internal/web/oidc/oidc.go b/internal/web/oidc/oidc.go
index 591b980..ba11f2b 100644
--- a/internal/web/oidc/oidc.go
+++ b/internal/web/oidc/oidc.go
@@ -242,9 +242,11 @@ func (d *DexAuth) handleCallback(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Single-user authz: only the allowlisted subject may sign in.
+	// Single-user authz: only the allowlisted subject may sign in. On mismatch
+	// we echo the caller's own subject (an opaque id, not a secret) so the
+	// maintainer can bootstrap TAPIR_ALLOWED_SUBJECT on first login.
 	if idToken.Subject != d.cfg.AllowedSubject {
-		http.Error(w, "forbidden", http.StatusForbidden)
+		http.Error(w, "forbidden — not the allowlisted subject. your subject is: "+idToken.Subject, http.StatusForbidden)
 		return
 	}