diff --git a/internal/hostagent/agent.go b/internal/hostagent/agent.go
index 17f4e36ca..99ef74875 100644
--- a/internal/hostagent/agent.go
+++ b/internal/hostagent/agent.go
@@ -282,6 +282,10 @@ func (a *Agent) process(ctx context.Context) error {
 		return fmt.Errorf("build report: %w", err)
 	}
 	if err := a.sendReport(ctx, report); err != nil {
+		if strings.Contains(err.Error(), "403 Forbidden") {
+			a.logger.Error().Msg("Failed to send host report (403 Forbidden). API token may lack 'Host agent reporting' scope. Set PULSE_ENABLE_HOST=false if host monitoring is not needed.")
+			return nil
+		}
 		a.logger.Warn().Err(err).Msg("Failed to send report, buffering")
 		a.reportBuffer.Push(report)
 		return nil