diff --git a/Cargo.lock b/Cargo.lock
index fcf3030a..630642ff 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1584,6 +1584,7 @@ dependencies = [
  "clap 3.1.18",
  "garage_util 0.7.0",
  "http",
+ "log",
  "rusoto_core",
  "rusoto_credential",
  "rusoto_signature",
diff --git a/src/k2v-client/Cargo.toml b/src/k2v-client/Cargo.toml
index 84c6b8b2..6106f4db 100644
--- a/src/k2v-client/Cargo.toml
+++ b/src/k2v-client/Cargo.toml
@@ -6,6 +6,7 @@ edition = "2018"
 [dependencies]
 base64 = "0.13.0"
 http = "0.2.6"
+log = "0.4"
 rusoto_core = "0.48.0"
 rusoto_credential = "0.48.0"
 rusoto_signature = "0.48.0"
diff --git a/src/k2v-client/src/lib.rs b/src/k2v-client/src/lib.rs
index ba1cd6ea..a5a7a0bb 100644
--- a/src/k2v-client/src/lib.rs
+++ b/src/k2v-client/src/lib.rs
@@ -4,6 +4,7 @@ use std::time::Duration;
 use http::header::{ACCEPT, CONTENT_LENGTH, CONTENT_TYPE};
 use http::status::StatusCode;
 use http::HeaderMap;
+use log::{debug, error};
 
 use rusoto_core::{ByteStream, DispatchSignedRequest, HttpClient};
 use rusoto_credential::AwsCredentials;
@@ -311,11 +312,27 @@ impl K2vClient {
 			StatusCode::NOT_FOUND => return Err(Error::NotFound),
 			StatusCode::NOT_MODIFIED => Vec::new(),
 			_ => {
+				let err_body = read_body(&mut res.headers, res.body)
+					.await
+					.unwrap_or_default();
+				error!(
+					"Error response {}: {}",
+					res.status,
+					std::str::from_utf8(&err_body)
+						.map(String::from)
+						.unwrap_or_else(|_| base64::encode(&err_body))
+				);
 				return Err(Error::InvalidResponse(
 					format!("invalid error code: {}", res.status).into(),
-				))
+				));
 			}
 		};
+		debug!(
+			"Response body: {}",
+			std::str::from_utf8(&body)
+				.map(String::from)
+				.unwrap_or_else(|_| base64::encode(&body))
+		);
 
 		Ok(Response {
 			body,