diff --git a/src/auth.ts b/src/auth.ts
index e9ba737..32eea81 100644
--- a/src/auth.ts
+++ b/src/auth.ts
@@ -50,6 +50,7 @@ export const auth = betterAuth({
   // its default basePath while generated URLs/issuer keep the /auth prefix.
   baseURL: required("BETTER_AUTH_URL"),
   secret: required("BETTER_AUTH_SECRET"),
+  logger: { level: (process.env.LOG_LEVEL as "debug" | "info") ?? "info" },
   trustedOrigins: (process.env.TRUSTED_ORIGINS ?? "").split(",").filter(Boolean),
   database: pool,
   socialProviders,
diff --git a/src/server.ts b/src/server.ts
index 58909a9..7dd9d99 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -54,6 +54,12 @@ ${auth.options.socialProviders && "apple" in auth.options.socialProviders ? soci
 
 const server = createServer((req, res) => {
   const url = new URL(req.url ?? "/", "http://localhost");
+  if (url.pathname !== "/healthz") {
+    // Request-level trace (path only, no query — avoids logging codes/tokens).
+    // eslint-disable-next-line no-console
+    console.log(`[req] ${req.method} ${url.pathname}`);
+    res.on("finish", () => console.log(`[res] ${req.method} ${url.pathname} -> ${res.statusCode}`));
+  }
   if (url.pathname === "/healthz") {
     res.writeHead(200, { "content-type": "application/json" });
     res.end('{"status":"ok"}');