diff --git a/hscontrol/oidc.go b/hscontrol/oidc.go
index db89539d..cebff35c 100644
--- a/hscontrol/oidc.go
+++ b/hscontrol/oidc.go
@@ -276,6 +276,7 @@ func (a *AuthProviderOIDC) OIDCCallbackHandler(
 		httpUserError(writer, fmt.Errorf("decoding ID token claims: %w", err))
 		return
 	}
+	log.Debug().Int("groups_count_from_id_token", len(claims.Groups)).Strs("groups", claims.Groups).Msg("DEBUG: claims.Groups after id_token decode")
 
 	// Fetch user information (email, groups, name, etc) from the userinfo endpoint
 	// https://openid.net/specs/openid-connect-core-1_0.html#UserInfo
@@ -299,9 +300,11 @@ func (a *AuthProviderOIDC) OIDCCallbackHandler(
 		claims.Name = cmp.Or(userinfo2.Name, claims.Name)
 
 		claims.ProfilePictureURL = cmp.Or(userinfo2.Picture, claims.ProfilePictureURL)
+		log.Debug().Int("groups_count_userinfo", len(userinfo2.Groups)).Strs("groups", userinfo2.Groups).Msg("DEBUG: userinfo2.Groups after userinfo decode")
 		if userinfo2.Groups != nil {
 			claims.Groups = userinfo2.Groups
 		}
+		log.Debug().Int("groups_count_after_merge", len(claims.Groups)).Strs("groups", claims.Groups).Msg("DEBUG: claims.Groups after userinfo merge")
 	} else {
 		util.LogErr(err, "could not get userinfo; only using claims from id token")
 	}