diff --git a/src/garage/secrets.rs b/src/garage/secrets.rs
index cb65bf84..66cc84dc 100644
--- a/src/garage/secrets.rs
+++ b/src/garage/secrets.rs
@@ -137,14 +137,18 @@ fn read_secret_file(file_path: &PathBuf, allow_world_readable: bool) -> Result<S
 		#[cfg(unix)]
 		{
 			use std::os::unix::fs::MetadataExt;
-			let metadata = std::fs::metadata(file_path)?;
+			let metadata = std::fs::metadata(file_path).map_err(|e| {
+				format!("Failed to read secret file {}: {}", file_path.display(), e)
+			})?;
+
 			if metadata.mode() & 0o077 != 0 {
 				return Err(format!("File {} is world-readable! (mode: 0{:o}, expected 0600)\nRefusing to start until this is fixed, or environment variable GARAGE_ALLOW_WORLD_READABLE_SECRETS is set to true.", file_path.display(), metadata.mode()).into());
 			}
 		}
 	}
 
-	let secret_buf = std::fs::read_to_string(file_path)?;
+	let secret_buf = std::fs::read_to_string(file_path)
+		.map_err(|e| format!("Failed to read secret file {}: {}", file_path.display(), e))?;
 
 	// trim_end: allows for use case such as `echo "$(openssl rand -hex 32)" > somefile`.
 	//           also editors sometimes add a trailing newline
diff --git a/src/util/config.rs b/src/util/config.rs
index aafc21b5..0395549e 100644
--- a/src/util/config.rs
+++ b/src/util/config.rs
@@ -282,7 +282,13 @@ pub fn default_block_max_concurrent_writes_per_request() -> usize {
 }
 /// Read and parse configuration
 pub fn read_config(config_file: PathBuf) -> Result<Config, Error> {
-	let config = std::fs::read_to_string(config_file)?;
+	let config = std::fs::read_to_string(&config_file).map_err(|e| {
+		format!(
+			"Failed to read config file {}: {}",
+			config_file.display(),
+			e
+		)
+	})?;
 
 	Ok(toml::from_str(&config)?)
 }