diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index df4be2b..ca3eecd 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -360,6 +360,14 @@ jobs:
             fi'
           echo "frontend and API both answering through rf.internal"
 
+      # No sudo: nginx's logs are world-readable and /var/log/nginx is
+      # traversable, so the deploy account can read them as itself. Reaching
+      # for sudo here would have meant widening the scoped whitelist for
+      # something it does not need.
       - name: nginx log
         if: always() && steps.auth.outcome == 'success'
-        run: ssh "$PROXY_HOST" 'sudo tail -n 50 /var/log/nginx/rf.internal.error.log'
+        run: |
+          for log in rf.internal rustingface.com; do
+            echo "--- /var/log/nginx/$log.error.log"
+            ssh "$PROXY_HOST" "tail -n 30 /var/log/nginx/$log.error.log"
+          done