diff --git a/cmd/orchestra-worker/main.go b/cmd/orchestra-worker/main.go
index 08d8d60..411f9ad 100644
--- a/cmd/orchestra-worker/main.go
+++ b/cmd/orchestra-worker/main.go
@@ -1462,6 +1462,11 @@ func main() {
 		if err := w.api.Register(context.Background(), w.registration); err != nil {
 			log.Fatalf("register %s: %v", spec.ID, err)
 		}
+		// Same reason as the coordinator's: the worker half of the pair must be
+		// checkable from journalctl, not only from the coordinator's
+		// credentialed worker list.
+		b := buildinfo.Current()
+		log.Printf("orchestra-worker revision %s built %s dirty %s", b.Revision, b.Time, b.Dirty)
 		log.Printf("serving harness %s (%s) on %s backend, state %s", spec.ID, spec.Harness, w.backend.Kind(), w.statePath)
 		workers = append(workers, w)
 	}
diff --git a/cmd/orchestra/main.go b/cmd/orchestra/main.go
index f44cbc0..155577c 100644
--- a/cmd/orchestra/main.go
+++ b/cmd/orchestra/main.go
@@ -1661,6 +1661,12 @@ func main() {
 	if port == "" {
 		port = "9145"
 	}
+	// Deployed identity, without a credential. A burn-in run pairs a
+	// coordinator and a worker, and matching revisions must be evidence rather
+	// than assumption. /v1/admin/diagnostics carries the same object behind
+	// the operator login.
+	b := buildinfo.Current()
+	log.Printf("orchestra revision %s built %s dirty %s", b.Revision, b.Time, b.Dirty)
 	log.Println("orchestra listening on :" + port)
 	tokens := map[authz.Surface]string{
 		authz.TUI: os.Getenv("ORCHESTRA_TUI_TOKEN"),