diff --git a/auth.go b/auth.go
index 57bbe68..121067f 100644
--- a/auth.go
+++ b/auth.go
@@ -182,8 +182,8 @@ func logsHandler(cfg Config, db *sql.DB) http.HandlerFunc {
 		logs := make([]map[string]interface{}, 0)
 		for rows.Next() {
 			var ts time.Time
-			var action, apiClientIP, reason string
-			var ip, cidr sql.NullString
+			var action, apiClientIP string
+			var ip, cidr, reason sql.NullString
 			var ttlSeconds sql.NullInt64
 			if err := rows.Scan(&ts, &action, &ip, &cidr, &ttlSeconds, &reason, &apiClientIP); err != nil {
 				continue
@@ -192,7 +192,7 @@ func logsHandler(cfg Config, db *sql.DB) http.HandlerFunc {
 				"timestamp":     ts,
 				"action":        action,
 				"api_client_ip": apiClientIP,
-				"reason":        reason,
+				"reason":        reason.String,
 			}
 			if ip.Valid {
 				entry["ip"] = ip.String
diff --git a/db.go b/db.go
index e020e42..b30315e 100644
--- a/db.go
+++ b/db.go
@@ -205,11 +205,14 @@ func CleanupExpiredTemp(db *sql.DB) error {
 		return err
 	}
 
+	var reason string
+	reason = "expired"
+
 	for _, ip := range expiredIPs {
 		_, err = db.Exec(`
-			INSERT INTO audit_log(action, ip)
-			VALUES('expire_temp', ?)
-		`, ip)
+			INSERT INTO audit_log(action, ip, reason)
+			VALUES('expire_temp', ?, ?)
+		`, ip, reason)
 		if err != nil {
 			slog.Warn("failed to log expired temp entry", "ip", ip, "error", err)
 		}
@@ -231,15 +234,16 @@ func ListTempEntries(db *sql.DB) ([]map[string]interface{}, error) {
 	defer rows.Close()
 	var list []map[string]interface{} = make([]map[string]interface{}, 0)
 	for rows.Next() {
-		var ip, reason string
+		var ip string
 		var expiresAt time.Time
+		var reason sql.NullString
 		if err := rows.Scan(&ip, &expiresAt, &reason); err != nil {
 			continue
 		}
 		list = append(list, map[string]interface{}{
 			"ip":      ip,
 			"expires": expiresAt,
-			"reason":  reason,
+			"reason":  reason.String,
 		})
 	}
 	return list, nil