diff --git a/dev/scripts/bootstrap_sso.py b/dev/scripts/bootstrap_sso.py
index 03a505b..9654ed6 100644
--- a/dev/scripts/bootstrap_sso.py
+++ b/dev/scripts/bootstrap_sso.py
@@ -460,6 +460,13 @@ def _ensure_dns(client: httpx.Client) -> None:
     if not r.json().get("success"):
         err = r.json().get("errors", [{}])[0].get("message", "unknown")
         print(f"  FAIL: DNS list — {err}")
+        if "Authentication" in err:
+            # The tunnel write above only needs Account:Cloudflare Tunnel:Edit;
+            # this one needs Zone:DNS:Edit *on the fhirworx.io zone*. A token
+            # scoped to another zone passes the first and fails here.
+            print(
+                f"        hint: the token must include Zone:DNS:Edit for {DOMAIN} (zone {zone})"
+            )
         return
 
     existing = {rec["name"] for rec in r.json()["result"]}