diff --git a/desktop-client/tunnel-helper/src/main.rs b/desktop-client/tunnel-helper/src/main.rs
index 03f4370..9bb87f0 100644
--- a/desktop-client/tunnel-helper/src/main.rs
+++ b/desktop-client/tunnel-helper/src/main.rs
@@ -598,13 +598,22 @@ fn connect_direct(profile: &Path) -> Result<(), String> {
         let wg_quick = find_wg_quick()?;
         let path_prefix = macos_command_path_prefix(&wg_quick);
         let command = format!("PATH='{}:$PATH' '{}' up '{}'", path_prefix, wg_quick.display(), profile.display());
-        let status = Command::new("osascript")
+        let output = Command::new("osascript")
             .arg("-e")
             .arg(format!("do shell script \"{}\" with administrator privileges", command))
-            .status()
+            .output()
             .map_err(|err| format!("unable to start tunnel: {err}"))?;
-        if !status.success() {
-            return Err(format!("macOS tunnel connect failed with status {status}"));
+        if !output.status.success() {
+            let stderr = String::from_utf8_lossy(&output.stderr);
+            let stdout = String::from_utf8_lossy(&output.stdout);
+            let detail = if !stderr.trim().is_empty() {
+                stderr.trim().to_string()
+            } else if !stdout.trim().is_empty() {
+                stdout.trim().to_string()
+            } else {
+                format!("exit status {}", output.status)
+            };
+            return Err(format!("macOS tunnel connect failed: {detail}"));
         }
         wait_for_macos_tunnel_running(profile)?;
         return Ok(());
@@ -700,7 +709,8 @@ fn tunnel_service_is_active(profile: &Path) -> Result<bool, String> {
     #[cfg(target_os = "macos")]
     {
         let tunnel_name = tunnel_name(profile)?;
-        let status = Command::new("wg")
+        let wg = find_wg_cli()?;
+        let status = Command::new(wg)
             .arg("show")
             .arg(tunnel_name)
             .status()