diff --git a/internal/envutil/github.go b/internal/envutil/github.go
index 1551b66d8..a82c9301c 100644
--- a/internal/envutil/github.go
+++ b/internal/envutil/github.go
@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	"github.com/github/gh-aw-mcpg/internal/logger"
+	"github.com/github/gh-aw-mcpg/internal/logger/sanitize"
 )
 
 var logGitHub = logger.New("envutil:github")
@@ -66,11 +67,13 @@ func DeriveGitHubAPIURL(defaultURL string) string {
 	if serverURL := strings.TrimSpace(os.Getenv("GITHUB_SERVER_URL")); serverURL != "" {
 		derived := deriveAPIFromServerURL(serverURL)
 		if derived != "" {
-			logGitHub.Printf("GitHub API URL derived from GITHUB_SERVER_URL=%s: %s", serverURL, derived)
+			logGitHub.Printf("GitHub API URL derived from GITHUB_SERVER_URL=%s: %s", sanitize.RedactURL(serverURL), sanitize.RedactURL(derived))
 			return derived
 		}
 	}
-	return strings.TrimRight(strings.TrimSpace(defaultURL), "/")
+	result := strings.TrimRight(strings.TrimSpace(defaultURL), "/")
+	logGitHub.Printf("GitHub API URL falling back to provided default: %s", sanitize.RedactURL(result))
+	return result
 }
 
 // deriveAPIFromServerURL converts a GITHUB_SERVER_URL to the corresponding API endpoint.
@@ -78,11 +81,15 @@ func DeriveGitHubAPIURL(defaultURL string) string {
 // GitHub.com: https://github.com → https://api.github.com
 // GHES (all others): https://github.example.com → https://github.example.com/api/v3
 func deriveAPIFromServerURL(serverURL string) string {
+	logGitHub.Printf("Deriving API URL from server URL: %s", sanitize.RedactURL(serverURL))
+
 	parsed, err := url.Parse(strings.TrimRight(serverURL, "/"))
 	if err != nil || parsed.Host == "" {
+		logGitHub.Printf("Failed to parse server URL or empty host: serverURL=%s, err=%v", sanitize.RedactURL(serverURL), err)
 		return ""
 	}
 	if parsed.Scheme != "http" && parsed.Scheme != "https" {
+		logGitHub.Printf("Unsupported scheme in server URL: scheme=%s, serverURL=%s", parsed.Scheme, sanitize.RedactURL(serverURL))
 		return ""
 	}
 
@@ -90,13 +97,20 @@ func deriveAPIFromServerURL(serverURL string) string {
 
 	switch {
 	case hostname == "github.com" || hostname == "www.github.com":
+		logGitHub.Printf("GitHub.com detected, using default API URL: %s", DefaultGitHubAPIBaseURL)
 		return DefaultGitHubAPIBaseURL
 	case strings.HasSuffix(hostname, ".ghe.com"):
+		var apiURL string
 		if port := parsed.Port(); port != "" {
-			return fmt.Sprintf("%s://copilot-api.%s:%s", parsed.Scheme, hostname, port)
+			apiURL = fmt.Sprintf("%s://copilot-api.%s:%s", parsed.Scheme, hostname, port)
+		} else {
+			apiURL = fmt.Sprintf("%s://copilot-api.%s", parsed.Scheme, hostname)
 		}
-		return fmt.Sprintf("%s://copilot-api.%s", parsed.Scheme, hostname)
+		logGitHub.Printf("GHEC tenant detected, using copilot-api subdomain: hostname=%s, apiURL=%s", hostname, apiURL)
+		return apiURL
 	default:
-		return fmt.Sprintf("%s://%s/api/v3", parsed.Scheme, parsed.Host)
+		apiURL := fmt.Sprintf("%s://%s/api/v3", parsed.Scheme, parsed.Host)
+		logGitHub.Printf("GHES instance detected, using /api/v3 path: host=%s, apiURL=%s", parsed.Host, apiURL)
+		return apiURL
 	}
 }