diff --git a/api/src/main/resources/application.yml b/api/src/main/resources/application.yml
index 11dd811cc..9561e3e1e 100644
--- a/api/src/main/resources/application.yml
+++ b/api/src/main/resources/application.yml
@@ -5,6 +5,8 @@ logging:
       OkHttpClient: WARN
 
 spring:
+  security:
+    debug: false
   ai:
     mcp:
       server:
diff --git a/common/src/main/kotlin/com/cosmotech/common/security/keycloak/KeycloakSecurityConfiguration.kt b/common/src/main/kotlin/com/cosmotech/common/security/keycloak/KeycloakSecurityConfiguration.kt
index 58728649c..2affde880 100644
--- a/common/src/main/kotlin/com/cosmotech/common/security/keycloak/KeycloakSecurityConfiguration.kt
+++ b/common/src/main/kotlin/com/cosmotech/common/security/keycloak/KeycloakSecurityConfiguration.kt
@@ -23,6 +23,7 @@ import org.springframework.security.authentication.AbstractAuthenticationToken
 import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity
 import org.springframework.security.config.annotation.web.builders.HttpSecurity
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
+import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer
 import org.springframework.security.core.GrantedAuthority
 import org.springframework.security.core.authority.SimpleGrantedAuthority
 import org.springframework.security.oauth2.core.DelegatingOAuth2TokenValidator
@@ -39,7 +40,7 @@ import org.springframework.util.CollectionUtils
 import org.springframework.util.StringUtils
 
 @Configuration
-@EnableWebSecurity(debug = true)
+@EnableWebSecurity
 @ConditionalOnProperty(
     name = ["csm.platform.identityProvider.code"],
     havingValue = "keycloak",
@@ -65,6 +66,13 @@ internal open class KeycloakSecurityConfiguration(
 
   @Value("\${csm.platform.identityProvider.tls.bundle}") private var tlsBundle: String = ""
 
+  @Value("\${spring.security.debug:false}") private var springSecurityDebug: Boolean = false
+
+  @Bean
+  fun webSecurityCustomizer(): WebSecurityCustomizer {
+    return WebSecurityCustomizer { customizer -> customizer.debug(springSecurityDebug) }
+  }
+
   @Bean(name = ["KeycloakFilterChain"])
   open fun filterChain(http: HttpSecurity): SecurityFilterChain {
     logger.info("Okta http security configuration")
diff --git a/config/application-dev.sample.yml b/config/application-dev.sample.yml
index bce77d611..0d64b0ca6 100644
--- a/config/application-dev.sample.yml
+++ b/config/application-dev.sample.yml
@@ -34,6 +34,8 @@ management:
     port: 8081
 
 spring:
+  security:
+    debug: false
   ssl:
     bundle:
       pem: