diff --git a/workspace-server/internal/handlers/approvals.go b/workspace-server/internal/handlers/approvals.go
index dcce896d6..ab2abe707 100644
--- a/workspace-server/internal/handlers/approvals.go
+++ b/workspace-server/internal/handlers/approvals.go
@@ -60,7 +60,9 @@ func (h *ApprovalsHandler) Create(c *gin.Context) {
 
 	// Auto-escalate to parent
 	var parentID *string
-	db.DB.QueryRowContext(ctx, `SELECT parent_id FROM workspaces WHERE id = $1`, workspaceID).Scan(&parentID)
+	if err := db.DB.QueryRowContext(ctx, `SELECT parent_id FROM workspaces WHERE id = $1`, workspaceID).Scan(&parentID); err != nil {
+		log.Printf("Create approval: parent lookup for workspace %s: %v", workspaceID, err)
+	}
 	if parentID != nil {
 		h.broadcaster.RecordAndBroadcast(ctx, string(events.EventApprovalEscalated), *parentID, map[string]interface{}{
 			"approval_id":       approvalID,
@@ -80,10 +82,12 @@ func (h *ApprovalsHandler) ListAll(c *gin.Context) {
 	ctx := c.Request.Context()
 
 	// Auto-expire stale approvals (older than 10 min)
-	db.DB.ExecContext(ctx, `
+	if _, err := db.DB.ExecContext(ctx, `
 		UPDATE approval_requests SET status = 'denied', decided_by = 'auto-expired', decided_at = now()
 		WHERE status = 'pending' AND created_at < now() - interval '10 minutes'
-	`)
+	`); err != nil {
+		log.Printf("ListAll: auto-expire stale approvals: %v", err)
+	}
 
 	rows, err := db.DB.QueryContext(ctx, `
 		SELECT a.id, a.workspace_id, w.name, a.action, a.reason, a.status, a.created_at
diff --git a/workspace-server/internal/handlers/terminal.go b/workspace-server/internal/handlers/terminal.go
index 8007391a8..c0fc3543b 100644
--- a/workspace-server/internal/handlers/terminal.go
+++ b/workspace-server/internal/handlers/terminal.go
@@ -110,9 +110,11 @@ func (h *TerminalHandler) HandleConnect(c *gin.Context) {
 	// workspace runs as a local Docker container on this tenant.
 	var instanceID string
 	if db.DB != nil {
-		db.DB.QueryRowContext(ctx,
+		if err := db.DB.QueryRowContext(ctx,
 			`SELECT COALESCE(instance_id, '') FROM workspaces WHERE id = $1`,
-			workspaceID).Scan(&instanceID)
+			workspaceID).Scan(&instanceID); err != nil {
+			log.Printf("HandleConnect: instance_id lookup for workspace %s: %v", workspaceID, err)
+		}
 	}
 
 	if instanceID != "" {
@@ -146,7 +148,9 @@ func (h *TerminalHandler) handleLocalConnect(c *gin.Context, workspaceID string)
 	// Look up workspace name for manual container naming
 	var wsName string
 	if db.DB != nil && h.docker != nil {
-		db.DB.QueryRowContext(ctx, `SELECT LOWER(REPLACE(name, ' ', '-')) FROM workspaces WHERE id = $1`, workspaceID).Scan(&wsName)
+		if err := db.DB.QueryRowContext(ctx, `SELECT LOWER(REPLACE(name, ' ', '-')) FROM workspaces WHERE id = $1`, workspaceID).Scan(&wsName); err != nil {
+			log.Printf("HandleConnect: workspace name lookup for %s: %v", workspaceID, err)
+		}
 		if wsName != "" {
 			candidates = append(candidates, wsName)
 		}