diff --git a/app/zabbix.py b/app/zabbix.py
index 67caf99..23622bc 100644
--- a/app/zabbix.py
+++ b/app/zabbix.py
@@ -120,7 +120,7 @@ class ZabbixClient:
     # ------------------------------------------------------------------ templates
 
     def get_template_id(self, name):
-        # Search by technical name (host field) — case-insensitive search with exactMatch fallback
+        # Search by technical name (host field) — case-insensitive search with exact-match fallback
         result = self._call('template.get', {
             'output': ['templateid', 'host'],
             'search': {'host': name},
@@ -130,7 +130,21 @@ class ZabbixClient:
         for t in result:
             if t['host'] == name:
                 return t['templateid']
-        return result[0]['templateid'] if result else None
+        # Log what IS visible to help diagnose permission issues
+        if result:
+            visible = [t['host'] for t in result]
+            log.warning("Template '%s' not found; visible templates: %s", name, visible)
+        else:
+            all_tpl = self._call('template.get', {'output': ['host'], 'limit': 5})
+            log.warning(
+                "Template '%s' not found and API token can see %d template(s) total (first 5: %s). "
+                "Fix in Zabbix: Administration → User groups → [your group] → "
+                "Template permissions → add 'Templates' group with Read access.",
+                name,
+                len(all_tpl),
+                [t['host'] for t in all_tpl],
+            )
+        return None
 
     def link_template(self, hostid, templateid):
         # host.update with templates replaces the list — fetch existing first to avoid unlinking others