diff --git a/.github/workflows/commit-queue.yml b/.github/workflows/commit-queue.yml
index a59140bc..c7fe8b61 100644
--- a/.github/workflows/commit-queue.yml
+++ b/.github/workflows/commit-queue.yml
@@ -84,9 +84,9 @@ jobs:
       # permissions neither task needs. The app happens to satisfy them today;
       # tightening its permissions, or installing it somewhere with fewer,
       # would break these silently behind the `|| true`. The endpoints below
-      # need only the pull request permission the app already has, and the
-      # label one names a single label rather than trusting a flag to be
-      # subtractive.
+      # need the app's `Issues: write` -- labels and comments are issue
+      # endpoints even when the number is a pull request's -- and the label one
+      # names a single label rather than trusting a flag to be subtractive.
       - name: Take the label back off
         if: always() && steps.token.outcome == 'success'
         env:
@@ -100,6 +100,22 @@ jobs:
             "repos/${GITHUB_REPOSITORY}/issues/${NUMBER}/labels/$(jq -rn --arg l "$LABEL" '$l|@uri')" \
             || true
 
+      # Everything that reports back needs the app's token, so a token that
+      # never minted leaves a bare red check and no reason for it -- the label
+      # still on, nothing said, in the one failure that greets a queue nobody
+      # has run yet. An annotation needs no token and no permission, so this is
+      # the one report that always survives.
+      - name: Say why no token could be minted
+        if: failure() && steps.token.outcome != 'success'
+        run: |
+          echo '::error title=The commit queue could not authenticate::' \
+            'No installation token could be minted, so nothing was read and' \
+            'nothing was merged. Either the app is not installed on this' \
+            'repository, or LAND_APP_ID / LAND_APP_PRIVATE_KEY is wrong --' \
+            'the private key must be the whole PEM, BEGIN and END lines' \
+            'included. The label is still on this pull request, and' \
+            'reapplying it starts nothing until it is taken off first.'
+
       - name: Say why it did not land
         if: failure() && steps.token.outcome == 'success'
         env: