diff --git a/router/event.go b/router/event.go
index d4ba737..33557a0 100644
--- a/router/event.go
+++ b/router/event.go
@@ -274,7 +274,11 @@ func (EventRouter) UploadPhotos(ctx context.Context, input *UploadEventPhotosInp
 	if err := service.EventServiceApp.AddPhotos(&event, middleware.CreateIdentityFromAuth(auth), uploads); err != nil {
 		if errors.Is(err, service.ErrPhotoStorage) {
 			util.Logger.Error(err)
-			return nil, huma.Error500InternalServerError(service.ErrPhotoStorage.Error())
+			detail := service.ErrPhotoStorage.Error()
+			if code := util.PhotoErrorCode(err); code != "" {
+				detail += ": OSS " + code
+			}
+			return nil, huma.Error500InternalServerError(detail)
 		}
 		return nil, huma.Error422UnprocessableEntity(err.Error())
 	}
diff --git a/util/photo.go b/util/photo.go
index 10a8a6f..d15a120 100644
--- a/util/photo.go
+++ b/util/photo.go
@@ -2,6 +2,7 @@ package util
 
 import (
 	"crypto/rand"
+	"errors"
 	"fmt"
 	"io"
 	"sync"
@@ -68,6 +69,14 @@ func (s *ossPhotoStore) SignURL(key string) (string, error) {
 	return bucket.SignURL(key, oss.HTTPGet, 3600)
 }
 
+func PhotoErrorCode(err error) string {
+	var serviceErr oss.ServiceError
+	if errors.As(err, &serviceErr) {
+		return serviceErr.Code
+	}
+	return ""
+}
+
 func PhotoKey(eventId int64, contentType string) string {
 	ext := ".jpg"
 	if contentType == "image/webp" {
diff --git a/util/photo_test.go b/util/photo_test.go
index 48f5ca0..9d38f1c 100644
--- a/util/photo_test.go
+++ b/util/photo_test.go
@@ -1,9 +1,12 @@
 package util_test
 
 import (
+	"errors"
+	"fmt"
 	"regexp"
 	"testing"
 
+	"github.com/aliyun/aliyun-oss-go-sdk/oss"
 	"github.com/nbtca/saturday/util"
 )
 
@@ -20,3 +23,13 @@ func TestPhotoKey(t *testing.T) {
 		t.Error("keys must be unique")
 	}
 }
+
+func TestPhotoErrorCode(t *testing.T) {
+	err := fmt.Errorf("failed to store photos: %w", oss.ServiceError{Code: "AccessDenied"})
+	if code := util.PhotoErrorCode(err); code != "AccessDenied" {
+		t.Errorf("got %q, want AccessDenied", code)
+	}
+	if code := util.PhotoErrorCode(errors.New("connection reset")); code != "" {
+		t.Errorf("got %q, want empty", code)
+	}
+}