diff --git a/image/entrypoint.sh b/image/entrypoint.sh
index d281556..07df778 100644
--- a/image/entrypoint.sh
+++ b/image/entrypoint.sh
@@ -18,14 +18,17 @@ if [[ -f "${DSH_HOME}/profiles/web/package.json" ]]; then
     if [[ -f "$pending_lockfile" ]]; then
         install_args+=(--no-frozen-lockfile)
     fi
-    if timeout --signal=TERM --kill-after=5s 120s env CI=true "${install_env[@]}" dsh plugin --profile web install --ignore-scripts "${install_args[@]}"; then
+    # Hide routine progress/peer warnings, but replay diagnostics on any failure.
+    if install_output=$(timeout --signal=TERM --kill-after=5s 120s env CI=true "${install_env[@]}" dsh plugin --profile web install --ignore-scripts "${install_args[@]}" 2>&1); then
         rm -f -- "$pending_lockfile"
         echo "dsh-mgr: plugin prestart reconciliation complete" >&2
     else
         status=$?
+        printf '%s\n' "$install_output" >&2
         echo "dsh-mgr: plugin prestart reconciliation failed (exit $status); application not started" >&2
         exit "$status"
     fi
+    unset install_output
 else
     echo "dsh-mgr: no web plugin manifest; using bundled plugins" >&2
 fi
diff --git a/image/entrypoint.test.mjs b/image/entrypoint.test.mjs
index 1ec37a9..23906e5 100644
--- a/image/entrypoint.test.mjs
+++ b/image/entrypoint.test.mjs
@@ -30,6 +30,8 @@ exec "$@"
 printf 'dsh %s\n' "$*" >> "$TRACE"
 test "$npm_config_ignore_scripts:$npm_config_ignore_pnpmfile" = true:true || exit 91
 if [ "$1" = plugin ]; then
+ echo 'install progress and peer warnings'
+ echo 'install stderr diagnostics' >&2
  test "$*" = "plugin --profile web install --ignore-scripts$EXPECTED_ARGS" || exit 92
  exit "$PLUGIN_STATUS"
 fi
@@ -59,9 +61,12 @@ sleep 0.1
       assert.match(trace, /dsh plugin --profile web install --ignore-scripts/);
       assert.equal(existsSync(join(dir, 'profiles/web/.dsh-lockfile-pending')), pending && status !== '0');
       if (status === '0') {
+        assert.doesNotMatch(output, /install progress|install stderr/);
         assert.match(output, /reconciliation complete/);
         assert.match(trace, /dsh web/);
       } else {
+        assert.match(result.stderr, /install progress and peer warnings/);
+        assert.match(result.stderr, /install stderr diagnostics/);
         assert.ok(output.includes('failed (exit ' + status + ')'), output);
         assert.doesNotMatch(trace, /caddy|dsh web/);
       }