diff --git a/apps/api/src/routes/setup.ts b/apps/api/src/routes/setup.ts
index 5fb4cb9..d8bae72 100644
--- a/apps/api/src/routes/setup.ts
+++ b/apps/api/src/routes/setup.ts
@@ -179,10 +179,10 @@ setupRouter.post('/validate/oidc', async (c) => {
     }
     return c.json({ ok: true }, 200);
   } catch (err) {
-    return c.json({
-      ok: false,
-      error: 'OIDC discovery failed: ' + (err instanceof Error ? err.message : String(err)),
-    }, 400);
+    // IN-01: Log raw error server-side only — do not echo internal network detail
+    // (e.g. "connect ECONNREFUSED 192.168.1.50:9091") to the pre-auth caller.
+    console.error('[setup/validate/oidc]', err instanceof Error ? err.message : String(err));
+    return c.json({ ok: false, error: 'OIDC discovery failed. Check the issuer URL.' }, 400);
   }
 });