diff --git a/scripts/discover-fortigate.sh b/scripts/discover-fortigate.sh
index 2abefc5..b8e71df 100755
--- a/scripts/discover-fortigate.sh
+++ b/scripts/discover-fortigate.sh
@@ -35,14 +35,22 @@ USER="${FORTIGATE_SSH_USER:-admin}"
 
 # FortiGate CLI command. `execute dhcp lease-list all` dumps every vdom.
 # If the device is single-vdom, `execute dhcp lease-list` (no arg) also works.
-# Send via stdin so we don't rely on interactive shell handling.
-raw=$(ssh -o BatchMode=no -o StrictHostKeyChecking=accept-new \
-        "${USER}@${HOST}" 'execute dhcp lease-list all' 2>/dev/null \
-      || ssh -o BatchMode=no -o StrictHostKeyChecking=accept-new \
-           "${USER}@${HOST}" 'execute dhcp lease-list' 2>/dev/null)
+#
+# Do NOT suppress stderr — FortiGate's error messages are the main debugging
+# signal when the command returns empty. Let them flow to the caller.
+
+raw=""
+for cmd in 'execute dhcp lease-list all' 'execute dhcp lease-list'; do
+  raw=$(ssh -o StrictHostKeyChecking=accept-new "${USER}@${HOST}" "$cmd" || true)
+  if [ -n "$raw" ] && ! grep -qiE 'unknown action|parse error|command fail' <<<"$raw"; then
+    break
+  fi
+done
 
 if [ -z "$raw" ]; then
-  echo "error: no lease data from $HOST (check SSH access / admin creds)" >&2
+  echo "error: no lease data from $HOST" >&2
+  echo "       — try running 'ssh ${USER}@${HOST}' interactively and running" >&2
+  echo "         'execute dhcp lease-list ?' to discover the right subcommand shape" >&2
   exit 1
 fi