diff --git a/ansible/plays/backup-influxdb.yml b/ansible/plays/backup-influxdb.yml
index c0a544de..b705a0eb 100644
--- a/ansible/plays/backup-influxdb.yml
+++ b/ansible/plays/backup-influxdb.yml
@@ -87,6 +87,29 @@
         path: "{{ influx_cli_path }}"
         mode: "0755"
 
+    # Diagnostics: confirm the token passed through CI matches what the
+    # user expects and that it can actually list authorizations.
+    - name: Show token prefix and length (sanity check on CI secret plumbing)
+      debug:
+        msg: "token prefix: {{ influx_token[:6] }}..., length: {{ influx_token | length }}"
+
+    - name: Probe token — can it read authorizations?
+      command: >
+        {{ influx_cli_path }} auth list
+        --host http://localhost:8086
+      environment:
+        INFLUX_TOKEN: "{{ influx_token }}"
+      register: auth_probe
+      changed_when: false
+      failed_when: false
+
+    - name: Show auth probe result
+      debug:
+        msg:
+          - "rc: {{ auth_probe.rc }}"
+          - "stderr: {{ auth_probe.stderr }}"
+          - "stdout_head: {{ (auth_probe.stdout_lines | default([]))[:3] }}"
+
     - name: Run influx backup (online, scoped to suedstr28/renner)
       command: >
         {{ influx_cli_path }} backup {{ backup_dir }}