diff --git a/internal/udisks/client.go b/internal/udisks/client.go
index 5b0bd90..fefdb30 100644
--- a/internal/udisks/client.go
+++ b/internal/udisks/client.go
@@ -16,7 +16,7 @@ type Client struct {
 func NewClient() (*Client, error) {
 	conn, err := dbus.SystemBus()
 	if err != nil {
-		return nil, fmt.Errorf("connecting to system bus: %w", err)
+		return nil, fmt.Errorf("cannot connect to udisks2 — is the udisks2 service running? (%w)", err)
 	}
 	return &Client{conn: conn}, nil
 }
@@ -39,7 +39,7 @@ func (c *Client) FindDevice(uuid, pathOrName string) (*BlockDevice, error) {
 				return &devices[i], nil
 			}
 		}
-		return nil, fmt.Errorf("no device with UUID %s", uuid)
+		return nil, fmt.Errorf("no device with UUID %s — run 'arca status' to list devices", uuid)
 	}
 
 	for i := range devices {
@@ -47,7 +47,7 @@ func (c *Client) FindDevice(uuid, pathOrName string) (*BlockDevice, error) {
 			return &devices[i], nil
 		}
 	}
-	return nil, fmt.Errorf("device %s not found", pathOrName)
+	return nil, fmt.Errorf("device %s not found — run 'arca status' to list devices or 'arca init' to generate config", pathOrName)
 }
 
 // ListEncryptedDevices returns all block devices with the Encrypted interface.
@@ -152,7 +152,7 @@ func (c *Client) listBlockDevices() ([]BlockDevice, error) {
 	var managed map[dbus.ObjectPath]map[string]map[string]dbus.Variant
 	err := obj.Call(ifaceObjectManager+".GetManagedObjects", 0).Store(&managed)
 	if err != nil {
-		return nil, fmt.Errorf("listing devices: %w", err)
+		return nil, fmt.Errorf("listing devices — is the udisks2 service running? (%w)", err)
 	}
 
 	var devices []BlockDevice
diff --git a/internal/unlock/unlock.go b/internal/unlock/unlock.go
index 630da4e..d5316b2 100644
--- a/internal/unlock/unlock.go
+++ b/internal/unlock/unlock.go
@@ -43,7 +43,7 @@ func (u *Unlocker) Unlock(dev *udisks.BlockDevice, methods []string) (*Result, e
 		}
 		errs = append(errs, fmt.Errorf("%s: %w", method, err))
 	}
-	return nil, fmt.Errorf("all unlock methods failed:\n%w", errors.Join(errs...))
+	return nil, fmt.Errorf("all unlock methods failed for %s:\n%w", dev.DevicePath, errors.Join(errs...))
 }
 
 func (u *Unlocker) tryMethod(dev *udisks.BlockDevice, method string) (*Result, error) {
@@ -96,7 +96,7 @@ func (u *Unlocker) unlockKeyfile(dev *udisks.BlockDevice) (*udisks.BlockDevice,
 func (u *Unlocker) unlockCryptsetup(dev *udisks.BlockDevice) (*udisks.BlockDevice, error) {
 	name := cryptsetup.MapperName(dev.DevicePath)
 	if err := cryptsetup.Open(dev.DevicePath, name); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("%w (is the FIDO2/TPM2 key plugged in?)", err)
 	}
 
 	// Wait for udisks2 to pick up the new dm device.