diff --git a/internal/api/handlers_passkey.go b/internal/api/handlers_passkey.go
index fdaf9f8..691928c 100644
--- a/internal/api/handlers_passkey.go
+++ b/internal/api/handlers_passkey.go
@@ -255,7 +255,7 @@ func (a *API) handlePasskeyRegisterFinish(w http.ResponseWriter, r *http.Request
 		writeError(w, r, err)
 		return
 	}
-	a.audit(r, auditActor(p), "account.passkey.registered", "")
+	a.audit(r, auditActor(p), "account.passkey.registered", cred.ID)
 	writeJSON(w, http.StatusCreated, passkeyView(cred))
 }
 
diff --git a/internal/api/handlers_passkey_test.go b/internal/api/handlers_passkey_test.go
index 35a95c2..764f543 100644
--- a/internal/api/handlers_passkey_test.go
+++ b/internal/api/handlers_passkey_test.go
@@ -125,18 +125,20 @@ func TestPasskeyRegisterVertical(t *testing.T) {
 		t.Fatalf("delete left %d credentials, want 0", len(repo.passkeyCreds))
 	}
 
-	// Both mutating halves audit by the caller's Access email.
+	// Both mutating halves audit by the caller's Access email AND name the affected
+	// credential id as the target, so an operator reading the log can tell which
+	// passkey was bound/unbound (register previously logged an empty target).
 	var registered, removed bool
 	for _, a := range repo.audits {
 		switch a.Action {
 		case "account.passkey.registered":
-			registered = a.Actor == "u1@example.net"
+			registered = a.Actor == "u1@example.net" && a.ServerName == id
 		case "account.passkey.removed":
-			removed = a.Actor == "u1@example.net"
+			removed = a.Actor == "u1@example.net" && a.ServerName == id
 		}
 	}
 	if !registered || !removed {
-		t.Errorf("want registered+removed audits by u1@example.net, got %+v", repo.audits)
+		t.Errorf("want registered+removed audits by u1@example.net targeting %s, got %+v", id, repo.audits)
 	}
 }