diff --git a/serving/fleet-manager/cli.go b/serving/fleet-manager/cli.go
index e4c1e55..b2f4d1e 100644
--- a/serving/fleet-manager/cli.go
+++ b/serving/fleet-manager/cli.go
@@ -18,6 +18,7 @@ import (
 	"crypto/subtle"
 	"encoding/base64"
 	"encoding/hex"
+	"errors"
 	"flag"
 	"fmt"
 	"os"
@@ -87,6 +88,11 @@ func loadEnrollKey(path string) ([]byte, error) {
 		return nil, fmt.Errorf("no enrol key file configured (FLEET_MGR_ENROLL_KEY_FILE)")
 	}
 	b, err := os.ReadFile(path)
+	if errors.Is(err, os.ErrNotExist) {
+		// The key is created by the admin bootstrap — a fresh secure-mode start
+		// before any admin exists lands here. Point at the fix, not the errno.
+		return nil, fmt.Errorf("enrol key %s not found — bootstrap the admin plane first: `fleet-manager register-admin <name>` (or set FLEET_MGR_ADMIN_INSECURE=true for dev)", path)
+	}
 	if err != nil {
 		return nil, err
 	}