diff --git a/server/db/mysql/tenant_adapter.go b/server/db/mysql/tenant_adapter.go
index 7c710e9..45d4333 100644
--- a/server/db/mysql/tenant_adapter.go
+++ b/server/db/mysql/tenant_adapter.go
@@ -8243,6 +8243,17 @@ func (a *adapter) TenantUserSecurityGetAuthVersion(id t.TenantID, uid t.Uid) (in
 		defer cancel()
 	}
 	decoded := decodeUID(uid)
+	var version int
+	err := a.db.GetContext(ctx, &version,
+		`SELECT auth_version FROM im_user_security WHERE user_id=?`,
+		decoded)
+	if err == nil {
+		return version, nil
+	}
+	if err != sql.ErrNoRows {
+		return 0, err
+	}
+
 	now := t.TimeNow()
 	securityID, err := nextSnowflakeID()
 	if err != nil {
@@ -8256,7 +8267,6 @@ func (a *adapter) TenantUserSecurityGetAuthVersion(id t.TenantID, uid t.Uid) (in
 	if err != nil {
 		return 0, err
 	}
-	var version int
 	err = a.db.GetContext(ctx, &version,
 		`SELECT auth_version FROM im_user_security WHERE user_id=?`,
 		decoded)
diff --git a/server/im_http.go b/server/im_http.go
index b02bc47..5a8f7b1 100644
--- a/server/im_http.go
+++ b/server/im_http.go
@@ -7099,6 +7099,7 @@ func verifyIMCodeChallenge(wrt http.ResponseWriter, req *http.Request, tenantID
 func authenticateIMHTTPBearer(wrt http.ResponseWriter, req *http.Request) (*imPrincipal, bool) {
 	principal, err := resolveIMHTTPBearer(req)
 	if err != nil {
+		logs.Warn.Printf("im http bearer auth failed request_id=%s method=%s path=%s err=%v", req.Header.Get("X-Request-ID"), req.Method, req.URL.Path, err)
 		if errors.Is(err, types.ErrUnsupported) {
 			writeIMError(wrt, req, http.StatusInternalServerError, 90000, imReasonInternal, "internal error", nil)
 		} else {