diff --git a/services/comms/synapse-signingkey-ensure-job.yaml b/services/comms/synapse-signingkey-ensure-job.yaml
index 00b7080..b1aed4d 100644
--- a/services/comms/synapse-signingkey-ensure-job.yaml
+++ b/services/comms/synapse-signingkey-ensure-job.yaml
@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: othrys-synapse-signingkey-ensure-2
+  name: othrys-synapse-signingkey-ensure-3
   namespace: comms
 spec:
   backoffLimit: 2
@@ -36,10 +36,12 @@ spec:
           args:
             - |
               set -euo pipefail
+              set -x
               if kubectl -n comms get secret othrys-synapse-signingkey \
-                -o jsonpath='{.data.signing\.key}' 2>/dev/null | grep -q .; then
+                -o jsonpath='{.data.signing\.key}' 2>/tmp/get_err | grep -q .; then
                 exit 0
               fi
+              cat /tmp/get_err >&2 || true
               kubectl -n comms create secret generic othrys-synapse-signingkey \
                 --from-file=signing.key=/work/signing.key \
                 --dry-run=client -o yaml | kubectl -n comms apply -f - >/dev/null