diff --git a/packages/db/src/auth/hooks/sso-provisioning.ts b/packages/db/src/auth/hooks/sso-provisioning.ts
index 60bdbc3f..ac6294c2 100644
--- a/packages/db/src/auth/hooks/sso-provisioning.ts
+++ b/packages/db/src/auth/hooks/sso-provisioning.ts
@@ -22,6 +22,12 @@ export async function ensureOrgMembership(
   roleId?: number
 ): Promise<void> {
   const emailLower = email.toLowerCase();
+  console.log('ensureOrgMembership', {
+    userId,
+    orgId,
+    roleId,
+    email
+  });
 
   const [existingByProfile] = await db
     .select()
diff --git a/packages/db/src/auth/hooks/tenant-provisioning.ts b/packages/db/src/auth/hooks/tenant-provisioning.ts
index 0e993bb4..c607da0e 100644
--- a/packages/db/src/auth/hooks/tenant-provisioning.ts
+++ b/packages/db/src/auth/hooks/tenant-provisioning.ts
@@ -1,7 +1,7 @@
-import { User } from 'better-auth';
 import { BRAND_ROOT_DOMAIN, TENANT_ROOT_DOMAIN, blockedSubdomain } from '@cio/utils/constants';
 import { getOrganizationByCustomDomain, getOrganizationBySiteName } from '@db/queries/organization';
 
+import { User } from 'better-auth';
 import { ensureOrgMembership } from './sso-provisioning';
 
 /**
@@ -70,14 +70,17 @@ async function resolveOrgIdFromHost(host: string): Promise<string | null> {
  */
 export const tenantProvisioningHook = async (user: User, request?: Request) => {
   if (!user.email || !request) return;
+  console.log('[auth] tenantProvisioningHook: running', { userId: user.id });
 
   const headerOrgId = request.headers.get('cio-org-id');
+  console.log('[auth] tenantProvisioningHook: headerOrgId', headerOrgId);
   if (headerOrgId) {
     await ensureOrgMembership(user.id, user.email, headerOrgId);
     return;
   }
 
   const host = request.headers.get('x-forwarded-host') ?? request.headers.get('host');
+  console.log('[auth] tenantProvisioningHook: host', host);
   if (!host) return;
 
   const orgId = await resolveOrgIdFromHost(host);