diff --git a/modules/services/zfsunlock/default.nix b/modules/services/zfsunlock/default.nix
index a3dca4e..888abc8 100644
--- a/modules/services/zfsunlock/default.nix
+++ b/modules/services/zfsunlock/default.nix
@@ -13,6 +13,7 @@
   }: let
     timeoutStr = builtins.toString pingTimeoutSec;
   in ''
+    set -x
     # if host is reachable via "pingEndpoint", which, we presume is
     # VPN (which implies the rootfs has been unlocked for VPN to work),
     # exit successfully.