diff --git a/cmd/jpictl/dns.go b/cmd/jpictl/dns.go
index 9b2fd32..3121279 100644
--- a/cmd/jpictl/dns.go
+++ b/cmd/jpictl/dns.go
@@ -163,9 +163,9 @@ var dnsAddCmd = &cobra.Command{
 			addr, err := core.ParseAddr(s)
 			switch {
 			case err != nil:
-				return core.Wrap(err, s)
+				return core.Wrap(err, "cannot parse address %q", s)
 			case !addr.IsValid(), addr.IsUnspecified(), addr.IsPrivate(), addr.IsMulticast():
-				return core.Wrap(core.ErrInvalid, s)
+				return core.Wrap(core.ErrInvalid, "address %q is invalid", s)
 			default:
 				addrs = append(addrs, addr)
 			}
diff --git a/pkg/ceph/config_parser.go b/pkg/ceph/config_parser.go
index dd3c054..afdb647 100644
--- a/pkg/ceph/config_parser.go
+++ b/pkg/ceph/config_parser.go
@@ -54,7 +54,7 @@ func loadGlobalConfField(cfg *GlobalConfig, field basic.Field) error {
 		err := cfg.FSID.UnmarshalText([]byte(field.Value))
 		switch {
 		case err != nil:
-			return core.Wrap(err, field.Key)
+			return core.Wrap(err, "unmarshal failed on field %q", field.Key)
 		default:
 			return nil
 		}
@@ -64,7 +64,7 @@ func loadGlobalConfField(cfg *GlobalConfig, field basic.Field) error {
 			var addr netip.Addr
 
 			if err := addr.UnmarshalText([]byte(s)); err != nil {
-				return core.Wrap(err, field.Key)
+				return core.Wrap(err, "unmarshal failed on field %q", field.Key)
 			}
 
 			cfg.MonitorsAddr = append(cfg.MonitorsAddr, addr)
@@ -83,7 +83,7 @@ func loadGlobalConfField(cfg *GlobalConfig, field basic.Field) error {
 		err := cfg.ClusterNetwork.UnmarshalText([]byte(field.Value))
 		switch {
 		case err != nil:
-			return core.Wrap(err, field.Key)
+			return core.Wrap(err, "unmarshal failed on field %q", field.Key)
 		default:
 			return nil
 		}
diff --git a/pkg/cluster/cluster_scan.go b/pkg/cluster/cluster_scan.go
index 326fd59..e98d6f4 100644
--- a/pkg/cluster/cluster_scan.go
+++ b/pkg/cluster/cluster_scan.go
@@ -51,7 +51,7 @@ func (m *Cluster) scanDirectory(opts *ScanOptions) error {
 			ok, err := m.scanSubdirectory(opts, e.Name())
 			switch {
 			case err != nil:
-				return core.Wrap(err, e.Name())
+				return core.Wrap(err, "cannot scan directory %q", e.Name())
 			case !ok:
 				m.warn(nil).
 					WithField("zone", e.Name()).
@@ -220,7 +220,7 @@ func (z *Zone) loadRegions() error {
 		// parsed
 		err = z.appendRegions(regions...)
 		if err != nil {
-			err = core.Wrap(err, filename)
+			err = core.Wrap(err, "cannot append region from file %q", filename)
 		}
 	}
 
@@ -247,7 +247,7 @@ func (z *Zone) loadClusterToken() error {
 
 	err = z.zones.setRegionClusterToken(z.Name, token)
 	if err != nil {
-		err = core.Wrap(err, filename)
+		err = core.Wrap(err, "wrong cluster token in file %q", filename)
 	}
 
 	return err
diff --git a/pkg/cluster/machine_rings.go b/pkg/cluster/machine_rings.go
index 8e4d744..e59a7bd 100644
--- a/pkg/cluster/machine_rings.go
+++ b/pkg/cluster/machine_rings.go
@@ -36,7 +36,7 @@ func (m *Machine) GetWireguardKeys(ringID rings.RingID) (wireguard.KeyPair, erro
 	out.PrivateKey, err = wireguard.PrivateKeyFromBase64(string(data))
 	if err != nil {
 		// bad key
-		err = core.Wrap(err, keyFile)
+		err = core.Wrap(err, "bad private key in file %q", keyFile)
 		return out, err
 	}
 
@@ -52,7 +52,7 @@ func (m *Machine) GetWireguardKeys(ringID rings.RingID) (wireguard.KeyPair, erro
 		out.PublicKey, err = wireguard.PublicKeyFromBase64(string(data))
 		if err != nil {
 			// bad key
-			err = core.Wrap(err, pubFile)
+			err = core.Wrap(err, "bad public key in %q", pubFile)
 			return out, err
 		}
 	}
@@ -227,10 +227,10 @@ func (m *Machine) applyWireguardPeerConfig(ring rings.RingID,
 	switch {
 	case !found:
 		// unknown
-		return core.Wrap(ErrUnknownNode, pc.Endpoint.Host)
+		return core.Wrap(ErrUnknownNode, "peer %q not found", pc.Endpoint.Host)
 	case ring == 1 && m.zone != peer.zone:
 		// invalid zone
-		return core.Wrap(ErrInvalidNode, peer.Name)
+		return core.Wrap(ErrInvalidNode, "peer %q invalid zone", peer.Name)
 	default:
 		// apply RingInfo
 		ri := &RingInfo{
diff --git a/pkg/cluster/machine_scan.go b/pkg/cluster/machine_scan.go
index 8d2e815..6c0702f 100644
--- a/pkg/cluster/machine_scan.go
+++ b/pkg/cluster/machine_scan.go
@@ -36,12 +36,12 @@ func (m *Machine) UpdatePublicAddresses() error {
 
 func (m *Machine) init() error {
 	if err := m.setID(); err != nil {
-		return core.Wrap(err, m.Name)
+		return core.Wrap(err, "cannot set ID for machine %q", m.Name)
 	}
 
 	for _, ring := range Rings {
 		if err := m.tryReadWireguardKeys(ring.ID); err != nil {
-			return core.Wrap(err, m.Name)
+			return core.Wrap(err, "cannot read keys for machine %q", m.Name)
 		}
 	}
 
diff --git a/pkg/dns/manager.go b/pkg/dns/manager.go
index 24dd62f..0484943 100644
--- a/pkg/dns/manager.go
+++ b/pkg/dns/manager.go
@@ -30,7 +30,7 @@ type ManagerOption func(*Manager) error
 
 func newErrorManagerOption(err error, hint string) ManagerOption {
 	return func(*Manager) error {
-		return core.Wrap(err, hint)
+		return core.Wrap(err, "%q", hint)
 	}
 }
 
diff --git a/pkg/wireguard/config_parser.go b/pkg/wireguard/config_parser.go
index 7a282d3..7719736 100644
--- a/pkg/wireguard/config_parser.go
+++ b/pkg/wireguard/config_parser.go
@@ -65,7 +65,7 @@ func loadInterfaceConfField(cfg *InterfaceConfig, field basic.Field) error {
 		err := cfg.Address.UnmarshalText([]byte(field.Value))
 		switch {
 		case err != nil:
-			return core.Wrap(err, field.Key)
+			return core.Wrap(err, "unmarshal failed on field %q", field.Key)
 		default:
 			return nil
 		}
@@ -77,7 +77,7 @@ func loadInterfaceConfField(cfg *InterfaceConfig, field basic.Field) error {
 		err := cfg.PrivateKey.UnmarshalText([]byte(field.Value))
 		switch {
 		case err != nil:
-			return core.Wrap(err, field.Key)
+			return core.Wrap(err, "unmarshal failed on field %q", field.Key)
 		default:
 			return nil
 		}
@@ -89,7 +89,7 @@ func loadInterfaceConfField(cfg *InterfaceConfig, field basic.Field) error {
 		u64, err := strconv.ParseUint(field.Value, 10, 16)
 		switch {
 		case err != nil:
-			return core.Wrap(err, field.Key)
+			return core.Wrap(err, "field %q is not an integer", field.Key)
 		case u64 == 0:
 			return core.Wrap(fs.ErrInvalid, "invalid %q value", field.Key)
 		default:
@@ -117,7 +117,7 @@ func loadPeerConfField(cfg *PeerConfig, field basic.Field) error {
 		err := cfg.PublicKey.UnmarshalText([]byte(field.Value))
 		switch {
 		case err != nil:
-			return core.Wrap(err, field.Key)
+			return core.Wrap(err, "unmarshal failed on field %q", field.Key)
 		default:
 			return nil
 		}
@@ -129,7 +129,7 @@ func loadPeerConfField(cfg *PeerConfig, field basic.Field) error {
 		err := cfg.Endpoint.UnmarshalText([]byte(field.Value))
 		switch {
 		case err != nil:
-			return core.Wrap(err, field.Key)
+			return core.Wrap(err, "unmarshal failed on field %q", field.Key)
 		default:
 			return nil
 		}
@@ -137,7 +137,7 @@ func loadPeerConfField(cfg *PeerConfig, field basic.Field) error {
 		s, err := parseAllowedIPs(field.Value)
 		switch {
 		case err != nil:
-			return core.Wrap(err, field.Key)
+			return core.Wrap(err, "%q is not an IP", field.Key)
 		case len(s) > 0:
 			cfg.AllowedIPs = append(cfg.AllowedIPs, s...)
 			return nil