diff --git a/scripts/src/platform-infra-pipelines-as-code-remote.sh b/scripts/src/platform-infra-pipelines-as-code-remote.sh
index 5c5b944c..ee35c5df 100644
--- a/scripts/src/platform-infra-pipelines-as-code-remote.sh
+++ b/scripts/src/platform-infra-pipelines-as-code-remote.sh
@@ -70,38 +70,29 @@ prepare_gitea_api_base() {
   export UNIDESK_PAC_GITEA_API_BASE_URL
 }
 
-resolve_service_url_to_cluster_ip() {
-  value="$1"
-  hostport=$(printf '%s' "$value" | sed -n 's#^http://\([^/]*\).*$#\1#p')
-  if ! printf '%s' "$hostport" | grep -q '\.svc\.cluster\.local'; then
-    printf '%s' "$value"
-    return
-  fi
-  host=${hostport%%:*}
-  port=${hostport##*:}
-  if [ "$port" = "$hostport" ]; then port=80; fi
-  service=${host%%.*}
-  rest=${host#*.}
-  namespace=${rest%%.*}
-  cluster_ip=$(kubectl -n "$namespace" get svc "$service" -o jsonpath='{.spec.clusterIP}')
-  printf '%s' "$value" | sed "s#^http://$hostport#http://$cluster_ip:$port#"
-}
-
 gitea_api() {
   method="$1"
   path="$2"
   body="${3:-}"
+  tmp=$(mktemp)
   if [ -n "$body" ]; then
-    curl -fsS -u "$UNIDESK_PAC_GITEA_ADMIN_USERNAME:$UNIDESK_PAC_GITEA_ADMIN_PASSWORD" \
+    code=$(curl -sS -o "$tmp" -w '%{http_code}' -u "$UNIDESK_PAC_GITEA_ADMIN_USERNAME:$UNIDESK_PAC_GITEA_ADMIN_PASSWORD" \
       -H 'Content-Type: application/json' \
       -X "$method" \
       --data "$body" \
-      "$(api_url "$path")"
+      "$(api_url "$path")" || true)
   else
-    curl -fsS -u "$UNIDESK_PAC_GITEA_ADMIN_USERNAME:$UNIDESK_PAC_GITEA_ADMIN_PASSWORD" \
+    code=$(curl -sS -o "$tmp" -w '%{http_code}' -u "$UNIDESK_PAC_GITEA_ADMIN_USERNAME:$UNIDESK_PAC_GITEA_ADMIN_PASSWORD" \
       -X "$method" \
-      "$(api_url "$path")"
+      "$(api_url "$path")" || true)
   fi
+  case "$code" in
+    2*) cat "$tmp"; rm -f "$tmp"; return 0 ;;
+  esac
+  response=$(head -c 500 "$tmp" | tr '\n' ' ' | sed 's/[[:space:]][[:space:]]*/ /g')
+  rm -f "$tmp"
+  printf 'gitea api %s %s failed: HTTP %s response=%s\n' "$method" "$path" "$code" "$response" >&2
+  return 22
 }
 
 ensure_token() {
diff --git a/scripts/src/platform-infra-pipelines-as-code.ts b/scripts/src/platform-infra-pipelines-as-code.ts
index 61b62763..2164d5fc 100644
--- a/scripts/src/platform-infra-pipelines-as-code.ts
+++ b/scripts/src/platform-infra-pipelines-as-code.ts
@@ -1008,12 +1008,14 @@ function renderPlan(result: Record<string, unknown>): RenderedCliResult {
 function renderApply(result: Record<string, unknown>): RenderedCliResult {
   const target = record(result.target);
   const remote = record(result.remote);
+  const errorText = compactLine(stringValue(remote.stderrTail, stringValue(remote.error, stringValue(result.error, ""))));
   const lines = [
     "PLATFORM-INFRA PIPELINES-AS-CODE APPLY",
     ...table(["TARGET", "MODE", "MUTATION", "OK"], [[stringValue(target.id), stringValue(result.mode), boolText(result.mutation), boolText(result.ok)]]),
     "",
     "REMOTE",
-    ...table(["CONTROLLER", "WEBHOOK", "REPOSITORY", "VALUES"], [[stringValue(remote.controllerReady), stringValue(record(remote.webhook).present), stringValue(remote.repository), "false"]]),
+    ...table(["CONTROLLER", "WEBHOOK", "REPOSITORY", "EXIT", "VALUES"], [[stringValue(remote.controllerReady), stringValue(record(remote.webhook).present), stringValue(remote.repository), stringValue(remote.exitCode, "0"), "false"]]),
+    ...(result.ok === false && errorText.length > 0 ? ["", `ERROR  ${errorText}`] : []),
     "",
     "NEXT",
     `  status: ${stringValue(record(result.next).status)}`,