diff --git a/src/cli/commands/recipient.ts b/src/cli/commands/recipient.ts
index 45a168d..da02f07 100644
--- a/src/cli/commands/recipient.ts
+++ b/src/cli/commands/recipient.ts
@@ -1,4 +1,4 @@
-import { adminFetch, expectOk } from '../signedFetch.js';
+import { adminFetch, expectOk, serverUrl } from '../signedFetch.js';
 
 export async function recipientAdd(label: string, publicKey: string): Promise<void> {
   const data = await expectOk(await adminFetch('POST', '/api/admin/recipients', { label, publicKey }));
@@ -20,9 +20,18 @@ export async function recipientRemove(recipientId: string): Promise<void> {
 }
 
 export async function adminOverview(): Promise<void> {
+  // Printed before the fetch, not after -- which server this hit is exactly
+  // the thing that's ambiguous from the rest of the output alone (no vault
+  // or recipient here says "production" or "dev"), and defaults silently
+  // to localhost:3050 if KEEP_SERVER_URL isn't set. Printing it first means
+  // it still shows up even when the fetch itself fails ("error: fetch
+  // failed") -- the exact case where knowing the target mattered most and
+  // previously showed nothing at all.
+  console.log(`server: ${serverUrl()}`);
+
   const data = await expectOk(await adminFetch('GET', '/api/admin/overview'));
 
-  console.log('recipients:');
+  console.log('\nrecipients:');
   if (!data.recipients.length) console.log('  none yet.');
   for (const r of data.recipients) {
     console.log(`  ${r.recipientId}  ${r.label}`);