diff --git a/src/lnurl_auth.rs b/src/lnurl_auth.rs
index 1ce44a7c35..9827d7c0c6 100644
--- a/src/lnurl_auth.rs
+++ b/src/lnurl_auth.rs
@@ -14,6 +14,7 @@ use bitcoin::hashes::{sha256, Hash, HashEngine, Hmac, HmacEngine};
 use bitcoin::secp256k1::{All, Message, Secp256k1, SecretKey};
 use bitreq::Client;
 use lightning::util::logger::Logger as LdkLogger;
+use lightning_types::string::PrintableString;
 use serde::{Deserialize, Serialize};
 
 use crate::logger::{log_debug, log_error, Logger};
@@ -86,8 +87,6 @@ impl LnurlAuth {
 			Error::InvalidLnurl
 		})?;
 
-		log_debug!(self.logger, "Starting LNURL-auth process for URL: {lnurl_auth_url}");
-
 		// Parse the URL to extract domain and parameters
 		let url = bitreq::Url::parse(&lnurl_auth_url).map_err(|e| {
 			log_error!(self.logger, "Invalid LNURL-auth URL: {e}");
@@ -96,6 +95,10 @@ impl LnurlAuth {
 
 		let domain = url.base_url();
 
+		// Only log the domain, the full URL carries the k1 challenge and potentially other
+		// credentials.
+		log_debug!(self.logger, "Starting LNURL-auth process for domain: {domain}");
+
 		// Enforce HTTPS for non-localhost URLs per LNURL spec.
 		let is_localhost = domain == "localhost" || domain == "127.0.0.1" || domain == "[::1]";
 		if url.scheme() != "https" && !is_localhost {
@@ -112,7 +115,11 @@ impl LnurlAuth {
 		})?;
 
 		if tag != "login" {
-			log_error!(self.logger, "Invalid tag parameter in LNURL-auth URL: {tag}");
+			log_error!(
+				self.logger,
+				"Invalid tag parameter in LNURL-auth URL: {}",
+				PrintableString(tag)
+			);
 			return Err(Error::InvalidLnurl);
 		}
 
@@ -158,7 +165,11 @@ impl LnurlAuth {
 			Ok(())
 		} else {
 			let reason = response.reason.unwrap_or_else(|| "Unknown error".to_string());
-			log_error!(self.logger, "LNURL-auth authentication failed: {reason}");
+			log_error!(
+				self.logger,
+				"LNURL-auth authentication failed: {}",
+				PrintableString(&reason)
+			);
 			Err(Error::LnurlAuthFailed)
 		}
 	}