diff --git a/internal/cachebroker/cachebroker_test.go b/internal/cachebroker/cachebroker_test.go
index 5c89623..2d36bb4 100644
--- a/internal/cachebroker/cachebroker_test.go
+++ b/internal/cachebroker/cachebroker_test.go
@@ -147,7 +147,8 @@ func TestHandlerReturnsExactScopedDeliveryOnce(t *testing.T) {
 		t.Fatal(err)
 	}
 	requestBody, _ := json.Marshal(ClaimRequest{InstanceName: "runner-example", RunnerName: "runner-example", Repository: "example-org/example-actions", Token: base64.RawURLEncoding.EncodeToString(token)})
-	handler := Handler{Config: config, Store: store, Logger: slog.New(slog.NewTextHandler(io.Discard, nil))}
+	var logs bytes.Buffer
+	handler := Handler{Config: config, Store: store, Logger: slog.New(slog.NewJSONHandler(&logs, nil))}
 	request := httptest.NewRequest(http.MethodPost, "https://gateway.example"+ClaimPath, bytes.NewReader(requestBody))
 	response := httptest.NewRecorder()
 	handler.ServeHTTP(response, request)
@@ -161,6 +162,12 @@ func TestHandlerReturnsExactScopedDeliveryOnce(t *testing.T) {
 	if delivery.Role != "trusted-writer" || delivery.PrefixRoot != "example-org/example-actions/trust/trusted" || delivery.AccessKey != "AKIA0123456789ABCDEF" {
 		t.Fatalf("delivery=%+v", delivery)
 	}
+	logged := logs.String()
+	if !strings.Contains(logged, `"msg":"cache claim delivered"`) || !strings.Contains(logged, `"repository":"example-org/example-actions"`) ||
+		!strings.Contains(logged, delivery.DeliveryID) ||
+		strings.Contains(logged, delivery.AccessKey) || strings.Contains(logged, delivery.SecretKeyB64) {
+		t.Fatalf("delivery evidence is missing or secret-bearing: %s", logged)
+	}
 	request = httptest.NewRequest(http.MethodPost, "https://gateway.example"+ClaimPath, bytes.NewReader(requestBody))
 	response = httptest.NewRecorder()
 	handler.ServeHTTP(response, request)
diff --git a/internal/cachebroker/handler.go b/internal/cachebroker/handler.go
index ec1f5a8..e7179c1 100644
--- a/internal/cachebroker/handler.go
+++ b/internal/cachebroker/handler.go
@@ -168,7 +168,11 @@ func (h Handler) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
 	writer.Header().Set("Content-Type", "application/json")
 	if err := json.NewEncoder(writer).Encode(delivery); err != nil {
 		logger.ErrorContext(ctx, "encode cache delivery", "error", err)
+		return
 	}
+	logger.InfoContext(ctx, "cache claim delivered", "repository", repositoryConfig.Name,
+		"role", identity.Role, "mode", identity.Mode,
+		"delivery_id", delivery.DeliveryID)
 }
 
 func validateJobCorrelation(request ClaimRequest) error {