diff --git a/scripts/trust/verify-manifest.sh b/scripts/trust/verify-manifest.sh
index 3223f79..f21e8d9 100755
--- a/scripts/trust/verify-manifest.sh
+++ b/scripts/trust/verify-manifest.sh
@@ -25,14 +25,23 @@ for component in "${components[@]}"; do
 
   if [[ ! -f "$manifest" ]]; then
     echo "missing trust manifest: $manifest" >&2
+    echo "  fix: ./scripts/trust/generate-manifest.sh $component" >&2
+    echo "  (or regenerate every component: just trust-generate)" >&2
     failed=1
     continue
   fi
 
-  if (cd "$component_dir" && sha256sum -c .trust/trust-manifest.sha256 >/dev/null); then
+  if output=$(cd "$component_dir" && sha256sum -c .trust/trust-manifest.sha256 2>&1); then
     echo "trust manifest verified: $component"
   else
     echo "trust manifest verification failed: $component" >&2
+    # Show the drifted/missing entries and any unexpected diagnostics
+    # (e.g. a corrupt manifest), but not the OK noise or sha256sum's
+    # redundant WARNING summary line.
+    grep -Ev ': OK$|^sha256sum: WARNING: ' <<<"$output" | sed 's/^/  /' >&2 || true
+    echo "  fix: ./scripts/trust/generate-manifest.sh $component" >&2
+    echo "  (or regenerate every component: just trust-generate)" >&2
+    echo "  then commit the updated $component/.trust/trust-manifest.sha256 in the SAME PR" >&2
     failed=1
   fi
 done