diff --git a/server/internal/grpc/proxystream.go b/server/internal/grpc/proxystream.go
index f3ef058..a5e80b7 100644
--- a/server/internal/grpc/proxystream.go
+++ b/server/internal/grpc/proxystream.go
@@ -24,7 +24,11 @@ func (s *vantageServer) ProxyStream(stream pb.Vantage_ProxyStreamServer) error {
 
 	srv, err := services.ValidateAgentToken(msg.Open.ServerId, msg.Open.AgentToken)
 	if err != nil {
-		return status.Error(codes.Unauthenticated, "invalid agent token")
+		// Deliberately identical to the claim-failure response below: a bad
+		// token, an unknown proxy_id, and a proxy_id belonging to another
+		// instance/server must be indistinguishable to the caller.
+		log.Printf("proxy %s (server %s): invalid agent token", msg.Open.ProxyId, msg.Open.ServerId)
+		return status.Error(codes.PermissionDenied, "proxy session unavailable")
 	}
 
 	if err := serveProxy(proxy.Default, msg.Open, srv.InstanceID, stream); err != nil {