diff --git a/packages/cli/script/silent-catch-baseline.json b/packages/cli/script/silent-catch-baseline.json
index 501d60e85..53555e678 100644
--- a/packages/cli/script/silent-catch-baseline.json
+++ b/packages/cli/script/silent-catch-baseline.json
@@ -64,7 +64,7 @@
   "src/lib/resolve-team.ts": 1,
   "src/lib/response-cache.ts": 7,
   "src/lib/scan/worker-pool.ts": 1,
-  "src/lib/scope-recovery.ts": 1,
+  "src/lib/scope-recovery.ts": 0,
   "src/lib/sdk-invoke.ts": 2,
   "src/lib/search-query.ts": 1,
   "src/lib/sentry-client.ts": 1,
diff --git a/packages/cli/src/lib/scope-recovery.ts b/packages/cli/src/lib/scope-recovery.ts
index 107952869..395f3f1b7 100644
--- a/packages/cli/src/lib/scope-recovery.ts
+++ b/packages/cli/src/lib/scope-recovery.ts
@@ -5,6 +5,7 @@ import { type AuthSource, getAuthConfig } from "./db/auth.js";
 import { ApiError, AuthError } from "./errors.js";
 import type { LoginResult } from "./interactive-login.js";
 import { interactivePromptsAllowed } from "./interactive-prompts.js";
+import { logger } from "./logger.js";
 import { OAUTH_SCOPES } from "./oauth.js";
 
 type InteractiveLogin = () => Promise<LoginResult | null>;
@@ -79,7 +80,8 @@ function hasActiveOAuthGrant(
 ): boolean {
   try {
     return runtime.getAuthSource() === "oauth";
-  } catch {
+  } catch (error) {
+    logger.debug("Failed to read auth source for OAuth grant check", error);
     return false;
   }
 }