diff --git a/.forgejo/workflows/grade.yml b/.forgejo/workflows/grade.yml
index 9ae7e97..790f3be 100644
--- a/.forgejo/workflows/grade.yml
+++ b/.forgejo/workflows/grade.yml
@@ -13,20 +13,26 @@ jobs:
     runs-on: docker
     container:
       image: gitea/runner-images:ubuntu-22.04
+      options: -v /opt/grade/runner-diag:/diag
     steps:
       - uses: actions/checkout@v4
       - name: Grade (blank fails, solved passes)
         env:
           GRADE_HMAC_SECRET: ${{ secrets.GRADE_HMAC_SECRET }}
         run: |
-          docker run --rm --network=none \
-            -v "$PWD":/work \
-            -v /opt/grade-hidden/cs2060/record-manager:/hidden:ro \
-            -e GRADE_HMAC_SECRET \
-            grade-c:dev \
-            python3 /opt/grade/grade_cli.py run \
-              --student /work --hidden /hidden \
-              --course CS2060 --assignment record-manager \
-              --out /work/results.json
-          echo "--- signed result summary ---"
-          head -c 400 results.json
+          LOG=/diag/$(date +%s).log
+          {
+            echo "PWD=$PWD"; echo "secret-len=${#GRADE_HMAC_SECRET}"
+            docker images | grep -E "grade-(c|harness)" || echo "NO GRADE IMAGES"
+            ls -la /opt/grade-hidden/cs2060/record-manager/ 2>&1 | head -3
+            docker run --rm --network=none \
+              -v "$PWD":/work \
+              -v /opt/grade-hidden/cs2060/record-manager:/hidden:ro \
+              -e GRADE_HMAC_SECRET \
+              grade-c:dev \
+              python3 /opt/grade/grade_cli.py run \
+                --student /work --hidden /hidden \
+                --course CS2060 --assignment record-manager \
+                --out /work/results.json 2>&1 | tail -20
+          } > "$LOG" 2>&1 || true
+          head -c 400 "$LOG"