diff --git a/server/app.py b/server/app.py
index ddeef59..5d530f3 100644
--- a/server/app.py
+++ b/server/app.py
@@ -845,7 +845,11 @@ def login(body: LoginIn, request: Request, response: Response, db: Session = Dep
                             detail="Sign-in is temporarily unavailable. Contact IT.")
 
     if not result.ok:
-        log.info("sign-in refused for %r (%s: %s)", sam, result.reason, result.detail)
+        # WARNING, not INFO: this is the line an operator needs when someone
+        # cannot sign in, and nothing configures the root logger — under plain
+        # uvicorn an INFO record from wpsuite.* goes nowhere, so the reason was
+        # invisible in exactly the situation it exists for.
+        log.warning("sign-in refused for %r (%s: %s)", sam, result.reason, result.detail)
         _record_bind_failure(sam)
         if user:
             user.failed_attempts = (user.failed_attempts or 0) + 1
diff --git a/server/ldap_auth.py b/server/ldap_auth.py
index ce1f89c..11c14c0 100644
--- a/server/ldap_auth.py
+++ b/server/ldap_auth.py
@@ -330,7 +330,7 @@ def verify(username: str, password: str, required_group: Optional[str] = None) -
             )
             if not conn.bind():
                 detail = _err49(conn.result)
-                log.info("bind refused for %r: %s", sam, detail)
+                log.warning("bind refused for %r: %s", sam, detail)
                 return LdapResult(False, BAD_CREDENTIALS, detail)
 
             # Bound as the user. AD lets an account read its own object, so no
@@ -351,8 +351,8 @@ def verify(username: str, password: str, required_group: Optional[str] = None) -
             if group:
                 try:
                     if not member_of(conn, sam, group):
-                        log.info("bind succeeded for %r but the account is not in %r",
-                                 sam, group)
+                        log.warning("bind succeeded for %r but the account is NOT in %r",
+                                    sam, group)
                         return LdapResult(False, NOT_IN_GROUP, f"not in {group}")
                 except LookupError:
                     return LdapResult(False, GROUP_NOT_FOUND, f"group {group!r} not found")