diff --git a/.changeset/callout-commands.md b/.changeset/callout-commands.md
index 883916c..83ae2e9 100644
--- a/.changeset/callout-commands.md
+++ b/.changeset/callout-commands.md
@@ -2,4 +2,4 @@
 "seamless-cli": minor
 ---
 
-Add `seamless webhooks`, `seamless hooks`, `seamless claims` and `seamless audit-sinks` to manage signed webhooks and their deliveries, `post_login` and `pre_token` login hooks, static custom claims, and audit log streaming to OTLP and syslog. Signing secrets are printed once, when they are issued. `hooks set` and `audit-sinks update` change only the settings a flag names, and `claims set` asks before removing a claim. Every command takes `--json`. They need auth server v0.23 or later, and an older instance gets a message saying so.
+Add `seamless webhooks`, `seamless hooks`, `seamless claims` and `seamless audit-sinks` to manage signed webhooks and their deliveries, `post_login` and `pre_token` login hooks, static custom claims, and audit log streaming to OTLP and syslog (syslog needs auth server v0.23.1, which v0.23.0 refuses). Signing secrets are printed once, when they are issued. `hooks set` and `audit-sinks update` change only the settings a flag names, and `claims set` asks before removing a claim. Every command takes `--json`. They need auth server v0.23 or later, and an older instance gets a message saying so.
diff --git a/src/commands/helpTopics.ts b/src/commands/helpTopics.ts
index 8cb28b0..04a4af4 100644
--- a/src/commands/helpTopics.ts
+++ b/src/commands/helpTopics.ts
@@ -974,6 +974,8 @@ audit-sinks create <name> --kind syslog --host <host> [--port <n>] [--transport
   • Both also take [--start-after-seq <n>] [--disabled] [--json]
   • otlp posts OTLP/HTTP JSON to <endpoint>/v1/logs. syslog is RFC 5424
     over TLS; tcp only outside production
+  • syslog needs auth server v0.23.1 or later. v0.23.0 refuses it until
+    its records carry the registered structured data ID
   • Credentials are never stored: name env vars on the auth server that
     end in _AUDIT_SINK_SECRET
   • Starts after the newest event, or replays from --start-after-seq
diff --git a/src/core/adminCallouts.test.ts b/src/core/adminCallouts.test.ts
index 4b38864..a5930d8 100644
--- a/src/core/adminCallouts.test.ts
+++ b/src/core/adminCallouts.test.ts
@@ -514,6 +514,15 @@ describe("audit sinks", () => {
     expect(await message(testAuditSink(client, SINK_ID))).toBe(expected);
   });
 
+  it("passes on the refusal of a syslog sink by auth server v0.23.0", async () => {
+    const refusal =
+      "Syslog audit sinks are not available in this release; they arrive in Seamless Auth 0.23.1. Use an OTLP sink until then.";
+    const { client } = fakeClient(() => response(400, { error: refusal }));
+    expect(
+      await message(createAuditSink(client, { name: "a", settings: syslog, enabled: true })),
+    ).toBe(`Could not create audit sink (400: ${refusal.slice(0, -1)}).`);
+  });
+
   it("reports any other failure on every sink route", async () => {
     const { client } = fakeClient(() => response(500, null));
     expect(await message(listAuditSinks(client))).toBe("Could not list audit sinks (500).");