diff --git a/apps/machine/src/services/lightning.ts b/apps/machine/src/services/lightning.ts
index 1f5f6fc..6509031 100644
--- a/apps/machine/src/services/lightning.ts
+++ b/apps/machine/src/services/lightning.ts
@@ -441,6 +441,16 @@ export async function initializeLightningServices(options?: {
     CONFIG.lnbitsServerPubkey || '(not configured)',
     envPubkey ? '(env)' : transport?.lnbitsServerPubkey ? '(pairing)' : '',
   )
+  // Operator pubkey provenance. Today the ONLY source is VITE_OPERATOR_PUBKEYS
+  // (env). An empty set disables the fees/operator-config services → the machine
+  // sits at "awaiting configuration" — so log it loudly rather than fail silent.
+  // (aiolabs/bitspire#70 P1 will source this from LNbits over the transport.)
+  console.log(
+    '[Lightning] Operator pubkey(s):',
+    CONFIG.operatorPubkeys.length
+      ? CONFIG.operatorPubkeys.join(', ') + ' (env)'
+      : '(none — fee/operator config gated until a server-delivered operator pubkey; #70 P1)',
+  )
 
   // Strict mode: validate the RESOLVED config is production-ready (no
   // localhost). Values may come from env or the pairing seed (#70).