diff --git a/scripts/smoke-vm.sh b/scripts/smoke-vm.sh
index 5166b89..b449a29 100755
--- a/scripts/smoke-vm.sh
+++ b/scripts/smoke-vm.sh
@@ -43,9 +43,22 @@ SHORT_SHA="${SHA:0:12}"
 API="https://${PVE_TEST_HOST}:8006/api2/json"
 
 api() {
-  curl --silent --show-error --fail-with-body -k \
+  # Wrapper so that on non-2xx we print the PVE response body to stderr
+  # before bubbling the failure — otherwise `--fail-with-body` output
+  # gets swallowed by callers that pipe to /dev/null, and you're left
+  # staring at "curl: (22)" with no idea which permission is missing.
+  local body rc
+  body=$(curl --silent --show-error --fail-with-body -k \
     --header "Authorization: PVEAPIToken=${PVE_TEST_TOKEN}" \
-    "$@"
+    "$@" 2>&1)
+  rc=$?
+  if [[ $rc -ne 0 ]]; then
+    echo "!! PVE API call failed (rc=$rc)" >&2
+    echo "!! request: $*" >&2
+    [[ -n "$body" ]] && echo "!! response: $body" >&2
+    return $rc
+  fi
+  printf '%s' "$body"
 }
 
 # PVE returns {"data": <payload>}; grab .data into a python expression.