diff --git a/cli/command/registry/login.go b/cli/command/registry/login.go
index 471e73f823..2b522910d8 100644
--- a/cli/command/registry/login.go
+++ b/cli/command/registry/login.go
@@ -19,6 +19,7 @@ import (
 	"github.com/docker/cli/internal/tui"
 	registrytypes "github.com/moby/moby/api/types/registry"
 	"github.com/moby/moby/client"
+	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 )
@@ -226,7 +227,7 @@ func loginWithStoredCredentials(ctx context.Context, dockerCLI command.Cli, auth
 	return resp.Auth.Status, err
 }
 
-func loginUser(ctx context.Context, dockerCLI command.Cli, opts loginOptions, defaultUsername, serverAddress string) (msg string, _ error) {
+func loginUser(ctx context.Context, dockerCLI command.Cli, opts loginOptions, defaultUsername, serverAddress string) (message string, _ error) {
 	// Some links documenting this:
 	// - https://code.google.com/archive/p/mintty/issues/56
 	// - https://github.com/docker/docker/issues/15272
@@ -240,13 +241,12 @@ func loginUser(ctx context.Context, dockerCLI command.Cli, opts loginOptions, de
 
 	// If we're logging into the index server and the user didn't provide a username or password, use the device flow
 	if serverAddress == registry.IndexServer && opts.user == "" && opts.password == "" {
-		var err error
-		msg, err = loginWithDeviceCodeFlow(ctx, dockerCLI)
-		// if the error represents a failure to initiate the device-code flow,
-		// then we fallback to regular cli credentials login
-		if !errors.Is(err, manager.ErrDeviceLoginStartFail) {
+		msg, err := loginWithDeviceCodeFlow(ctx, dockerCLI)
+		if err == nil || !errors.Is(err, manager.ErrDeviceLoginStartFail) {
 			return msg, err
 		}
+
+		logrus.WithError(err).Debug("failed to start web-based login")
 		_, _ = fmt.Fprint(dockerCLI.Err(), "Failed to start web-based login - falling back to command line login...\n\n")
 	}
 
diff --git a/internal/oauth/manager/manager.go b/internal/oauth/manager/manager.go
index 77d17d0418..9816f7de18 100644
--- a/internal/oauth/manager/manager.go
+++ b/internal/oauth/manager/manager.go
@@ -18,8 +18,6 @@ import (
 	"github.com/docker/cli/internal/registry"
 	"github.com/docker/cli/internal/tui"
 	"github.com/morikuni/aec"
-	"github.com/sirupsen/logrus"
-
 	"github.com/pkg/browser"
 )
 
@@ -89,13 +87,11 @@ func (m *OAuthManager) LoginDevice(ctx context.Context, w io.Writer) (*types.Aut
 
 	state, err := m.api.GetDeviceCode(ctx, m.audience)
 	if err != nil {
-		logrus.Debugf("failed to start device code login: %v", err)
-		return nil, ErrDeviceLoginStartFail
+		return nil, fmt.Errorf("%w: %w", ErrDeviceLoginStartFail, err)
 	}
 
 	if state.UserCode == "" {
-		logrus.Debugf("failed to start device code login: missing user code")
-		return nil, ErrDeviceLoginStartFail
+		return nil, fmt.Errorf("%w: missing user code", ErrDeviceLoginStartFail)
 	}
 
 	var out tui.Output