diff --git a/internal/cmdexec/remote.go b/internal/cmdexec/remote.go
index b9903d21..33ddd117 100644
--- a/internal/cmdexec/remote.go
+++ b/internal/cmdexec/remote.go
@@ -30,19 +30,16 @@ func (r *Remote) Run(ctx context.Context, cmd string) (string, error) {
 	done := make(chan result)
 	go func() {
 		outBytes, outErr := session.CombinedOutput(cmd)
-		res := result{
+		done <- result{
+			out: strings.TrimSpace(string(outBytes)),
 			err: outErr,
 		}
-		if outErr == nil {
-			res.out = strings.TrimSpace(string(outBytes))
-		}
-		done <- res
 	}()
 
 	select {
 	case res := <-done:
 		if res.err != nil {
-			return "", fmt.Errorf("run command on remote host: %w", res.err)
+			return res.out, fmt.Errorf("run command on remote host: %w: %s", res.err, res.out)
 		}
 		return res.out, nil
 	case <-ctx.Done():
diff --git a/internal/machine/token.go b/internal/machine/token.go
index 1bbc529c..68ded8f2 100644
--- a/internal/machine/token.go
+++ b/internal/machine/token.go
@@ -29,8 +29,8 @@ func NewToken(publicKey secret.Secret, endpoints []netip.AddrPort) Token {
 
 // ParseToken decodes a machine token from the given string.
 func ParseToken(s string) (Token, error) {
-	if strings.HasPrefix(s, TokenPrefix) {
-		return Token{}, fmt.Errorf("invalid token prefix")
+	if !strings.HasPrefix(s, TokenPrefix) {
+		return Token{}, fmt.Errorf("invalid token prefix: %s", s)
 	}
 	decoded, err := base64.StdEncoding.DecodeString(s[len(TokenPrefix):])
 	if err != nil {