diff --git a/__tests__/saveCache.test.ts b/__tests__/saveCache.test.ts
index f747da1..9178464 100644
--- a/__tests__/saveCache.test.ts
+++ b/__tests__/saveCache.test.ts
@@ -265,6 +265,7 @@ test('save with reserve cache denied by read-only token logs warning (not info)'
     `Failed to save: Unable to reserve cache with key ${primaryKey}. More details: ${deniedMessage}`
   )
 
+  expect(logWarningMock).toHaveBeenCalledTimes(1)
   expect(reserveCacheMock).toHaveBeenCalledTimes(1)
   expect(createTarMock).toHaveBeenCalledTimes(1)
   expect(saveCacheMock).toHaveBeenCalledTimes(0)
diff --git a/__tests__/saveCacheV2.test.ts b/__tests__/saveCacheV2.test.ts
index c292bec..af7aa3d 100644
--- a/__tests__/saveCacheV2.test.ts
+++ b/__tests__/saveCacheV2.test.ts
@@ -154,6 +154,7 @@ test('create cache entry denied by read-only token logs single warning and skips
     `Failed to save: Unable to reserve cache with key ${key}. More details: ${deniedMessage}`
   )
 
+  expect(warningLogMock).toHaveBeenCalledTimes(1)
   expect(createCacheEntryMock).toHaveBeenCalledWith({
     key,
     version: cacheVersion
diff --git a/src/cache.ts b/src/cache.ts
index 3f66c6f..c534040 100644
--- a/src/cache.ts
+++ b/src/cache.ts
@@ -45,8 +45,9 @@ export const CACHE_WRITE_DENIED_PREFIX = 'cache write denied:'
  * Raised when the cache backend refuses to reserve a writable cache entry
  * because the JWT issued for this run was scoped read-only (for example, the
  * run was triggered by an event the repository administrator classified as
- * untrusted). The error message is forwarded verbatim from the receiver and
- * always begins with `cache write denied:`.
+ * untrusted). The receiver-supplied detail message always begins with
+ * `cache write denied:` (the full error message includes additional context
+ * like the cache key).
  *
  * Extends ReserveCacheError for source-compatibility: existing
  * `instanceof ReserveCacheError` checks and `typedError.name ===