diff --git a/src/Tgstation.Server.Host/Security/AuthenticationContextFactory.cs b/src/Tgstation.Server.Host/Security/AuthenticationContextFactory.cs
index aa019be91f..45935ac098 100644
--- a/src/Tgstation.Server.Host/Security/AuthenticationContextFactory.cs
+++ b/src/Tgstation.Server.Host/Security/AuthenticationContextFactory.cs
@@ -64,6 +64,7 @@ namespace Tgstation.Server.Host.Security
 				.ConfigureAwait(false);
 			if (user == default)
 			{
+				logger.LogWarning("Unable to find user with ID {0}!", userId);
 				CurrentAuthenticationContext = new AuthenticationContext();
 				return;
 			}
@@ -75,6 +76,7 @@ namespace Tgstation.Server.Host.Security
 			{
 				if (user.LastPasswordUpdate.HasValue && user.LastPasswordUpdate > validAfter)
 				{
+					logger.LogDebug("Rejecting token for user {0} created before last password update: {1}", userId, user.LastPasswordUpdate.Value);
 					CurrentAuthenticationContext = new AuthenticationContext();
 					return;
 				}
diff --git a/src/Tgstation.Server.Host/Security/ClaimsInjector.cs b/src/Tgstation.Server.Host/Security/ClaimsInjector.cs
index 7fd31958de..e99ef64f2c 100644
--- a/src/Tgstation.Server.Host/Security/ClaimsInjector.cs
+++ b/src/Tgstation.Server.Host/Security/ClaimsInjector.cs
@@ -1,9 +1,11 @@
 using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Logging;
 using System;
 using System.Collections.Generic;
 using System.Globalization;
 using System.IdentityModel.Tokens.Jwt;
+using System.Linq;
 using System.Security.Claims;
 using System.Threading;
 using System.Threading.Tasks;
@@ -20,13 +22,20 @@ namespace Tgstation.Server.Host.Security
 		/// </summary>
 		readonly IAuthenticationContextFactory authenticationContextFactory;
 
+		/// <summary>
+		/// The <see cref="ILogger"/> for the <see cref="ClaimsInjector"/>.
+		/// </summary>
+		readonly ILogger<ClaimsInjector> logger;
+
 		/// <summary>
 		/// Construct a <see cref="ClaimsInjector"/>
 		/// </summary>
 		/// <param name="authenticationContextFactory">The value of <see cref="authenticationContextFactory"/></param>
-		public ClaimsInjector(IAuthenticationContextFactory authenticationContextFactory)
+		/// <param name="logger">The value of <see cref="logger"/></param>
+		public ClaimsInjector(IAuthenticationContextFactory authenticationContextFactory, ILogger<ClaimsInjector> logger)
 		{
 			this.authenticationContextFactory = authenticationContextFactory ?? throw new ArgumentNullException(nameof(authenticationContextFactory));
+			this.logger = logger ?? throw new ArgumentNullException(nameof(logger));
 		}
 
 		/// <inheritdoc />
@@ -86,6 +95,7 @@ namespace Tgstation.Server.Host.Security
 						claims.Add(new Claim(ClaimTypes.Role, RightsHelper.RoleName(I, J)));
 			}
 
+			logger.LogTrace("User {0} claims: {1}", authenticationContext.User.Id, String.Join(", ", claims.Select(x => x.Value)));
 			tokenValidatedContext.Principal.AddIdentity(new ClaimsIdentity(claims));
 		}
 	}