diff --git a/storage/file/file.go b/storage/file/file.go
index 82a3770..e06f1a3 100644
--- a/storage/file/file.go
+++ b/storage/file/file.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"io/fs"
 	"os"
 	"path"
@@ -65,7 +66,7 @@ func (s *FileStorage) RetrieveAuthTokens(_ context.Context, name string) (*clien
 	tokens := new(client.OAuth1Tokens)
 	err := decodeJSONfile(s.tokensFilename(name), tokens)
 	if errors.Is(err, os.ErrNotExist) {
-		err = storage.ErrNotFound
+		err = fmt.Errorf("%v: %w", err, storage.ErrNotFound)
 	}
 	return tokens, err
 }
@@ -173,14 +174,14 @@ func (s *FileStorage) RetrieveTokenPKI(_ context.Context, name string) ([]byte,
 	certBytes, err := os.ReadFile(s.tokenpkiFilename(name, "cert"))
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
-			return nil, nil, storage.ErrNotFound
+			return nil, nil, fmt.Errorf("%v: %w", err, storage.ErrNotFound)
 		}
 		return nil, nil, err
 	}
 	keyBytes, err := os.ReadFile(s.tokenpkiFilename(name, "key"))
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
-			return nil, nil, storage.ErrNotFound
+			return nil, nil, fmt.Errorf("%v: %w", err, storage.ErrNotFound)
 		}
 		return nil, nil, err
 	}
diff --git a/storage/mysql/mysql.go b/storage/mysql/mysql.go
index 79504ae..cc92147 100644
--- a/storage/mysql/mysql.go
+++ b/storage/mysql/mysql.go
@@ -5,6 +5,7 @@ import (
 	"database/sql"
 	_ "embed"
 	"errors"
+	"fmt"
 	"time"
 
 	"github.com/micromdm/nanodep/client"
@@ -108,12 +109,12 @@ WHERE
 	)
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
-			return nil, storage.ErrNotFound
+			return nil, fmt.Errorf("%v: %w", err, storage.ErrNotFound)
 		}
 		return nil, err
 	}
 	if !consumerKey.Valid { // all auth token fields are set together
-		return nil, storage.ErrNotFound
+		return nil, fmt.Errorf("consumer key not valid: %w", storage.ErrNotFound)
 	}
 	accessTokenExpiryTime, err := time.Parse(timestampFormat, accessTokenExpiry.String)
 	if err != nil {
@@ -315,12 +316,12 @@ func (s *MySQLStorage) RetrieveTokenPKI(ctx context.Context, name string) (pemCe
 		&pemCert, &pemKey,
 	); err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
-			return nil, nil, storage.ErrNotFound
+			return nil, nil, fmt.Errorf("%v: %w", err, storage.ErrNotFound)
 		}
 		return nil, nil, err
 	}
 	if pemCert == nil { // tokenpki_cert_pem and tokenpki_key_pem are set together
-		return nil, nil, storage.ErrNotFound
+		return nil, nil, fmt.Errorf("empty certificate: %w", storage.ErrNotFound)
 	}
 	return pemCert, pemKey, nil
 }