diff --git a/main.go b/main.go
index 860c1c1..d5d38e7 100644
--- a/main.go
+++ b/main.go
@@ -136,7 +136,6 @@ func tsproxy(ctx context.Context) error {
 	}
 
 	logger := slog.New(slog.NewJSONHandler(os.Stderr))
-	// see ReverseProxy.ErrorLog; this ensures these logs go to our logger.
 	slog.SetDefault(logger)
 
 	st, err := tsWaitStatusReady(ctx, &tailscale.LocalClient{})
@@ -223,7 +222,7 @@ func tsproxy(ctx context.Context) error {
 			Handler: promhttp.InstrumentHandlerInFlight(requestsInFlight,
 				promhttp.InstrumentHandlerDuration(duration,
 					promhttp.InstrumentHandlerCounter(requests,
-						newReverseProxy(log, lc, upstream.backend)))),
+						newReverseProxy(log.With(slog.String("upstream", upstream.name)), lc, upstream.backend)))),
 		}
 
 		g.Add(func() error {
diff --git a/tsproxy.go b/tsproxy.go
index fb7bd6e..190d5ae 100644
--- a/tsproxy.go
+++ b/tsproxy.go
@@ -61,6 +61,10 @@ func newReverseProxy(logger *slog.Logger, lc tailscaleLocalClient, url *url.URL)
 			req.Out.Host = req.In.Host
 		},
 	}
+	rproxy.ErrorHandler = func(w http.ResponseWriter, r *http.Request, err error) {
+		http.Error(w, http.StatusText(http.StatusBadGateway), http.StatusBadGateway)
+		logger.Error("upstream error", err)
+	}
 
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		whois, err := lc.WhoIs(r.Context(), r.RemoteAddr)