diff --git a/dovecot/keyproxy.go b/dovecot/keyproxy.go
index 680aa74eb5b8a9ac722d2ca3e370277a669df0eb..a7edf35538e77fc33ba78c21b7a9695fd3d481dc 100644
--- a/dovecot/keyproxy.go
+++ b/dovecot/keyproxy.go
@@ -122,7 +122,9 @@ func (s *KeyLookupProxy) lookupPassdb(ctx context.Context, username, password st
 	// If the password is a SSO token, try to fetch the
 	// unencrypted key from the keystore daemon.
 	priv, err := s.keystore.Get(ctx, s.config.Shard, username, password)
-	if err == nil {
+	if err != nil {
+		log.Printf("keystore lookup for %s failed: %v", username, err)
+	} else {
 		log.Printf("passdb lookup for %s (from keystore)", username)
 		return &passdbResponse{PrivateKey: s.b64encode(priv)}, true, nil
 	}