diff --git a/apps/server/src/cloud/ManagedEndpointRuntime.test.ts b/apps/server/src/cloud/ManagedEndpointRuntime.test.ts
index e0d5924fcc2..b45b5099252 100644
--- a/apps/server/src/cloud/ManagedEndpointRuntime.test.ts
+++ b/apps/server/src/cloud/ManagedEndpointRuntime.test.ts
@@ -96,6 +96,15 @@ describe("CloudManagedEndpointRuntime", () => {
         "2026-06-17T02:00:00Z INF Starting metrics server",
       ),
     ).toBe("debug");
+    // FTL (fatal) and PNC (panic) are more severe than ERR and must surface.
+    expect(
+      ManagedEndpointRuntime.classifyRelayClientOutput(
+        "2026-06-17T02:00:00Z FTL Cannot determine default origin certificate path",
+      ),
+    ).toBe("warning");
+    expect(
+      ManagedEndpointRuntime.classifyRelayClientOutput("2026-06-17T02:00:00Z PNC runtime panic"),
+    ).toBe("warning");
   });
 
   it.effect("starts, deduplicates, rotates, and stops the Cloudflare connector", () =>
diff --git a/apps/server/src/cloud/ManagedEndpointRuntime.ts b/apps/server/src/cloud/ManagedEndpointRuntime.ts
index a1d7112a929..89c0a23783c 100644
--- a/apps/server/src/cloud/ManagedEndpointRuntime.ts
+++ b/apps/server/src/cloud/ManagedEndpointRuntime.ts
@@ -72,7 +72,10 @@ export function classifyRelayClientOutput(line: string): "connected" | "warning"
   if (/\bRegistered tunnel connection\b/iu.test(line)) {
     return "connected";
   }
-  return /\b(?:ERR|WRN)\b/u.test(line) ? "warning" : "debug";
+  // cloudflared uses zerolog level tokens. FTL (fatal) and PNC (panic) are more
+  // severe than ERR, so they must surface at least as loudly — without them a
+  // fatal connector failure would be logged at debug and hidden.
+  return /\b(?:ERR|WRN|FTL|PNC)\b/u.test(line) ? "warning" : "debug";
 }
 
 function runtimeConfigKey(config: RelayManagedEndpointRuntimeConfig): string {