diff --git a/.env b/.env
index d15e9bd..f081589 100644
--- a/.env
+++ b/.env
@@ -8,7 +8,7 @@ WEB_PORT=3000
 CSRF_ALLOWED_ORIGINS=http://localhost:3000
 EXTERNAL_PERSONS_URL=
 EXTERNAL_PERSONS_API_KEY=
-EXTERNAL_CLIENT_CERT_FILE=
-EXTERNAL_CLIENT_KEY_FILE=
+EXTERNAL_CLIENT_CERT_FILE=/app/certs/client.crt
+EXTERNAL_CLIENT_KEY_FILE=/app/certs/client.key
 EXTERNAL_CA_CERT_FILE=""
 EXTERNAL_DANGER_ACCEPT_INVALID_CERTS=false
diff --git a/api/src/routes/persons.rs b/api/src/routes/persons.rs
index 61b1415..c4b1418 100644
--- a/api/src/routes/persons.rs
+++ b/api/src/routes/persons.rs
@@ -93,11 +93,28 @@ pub async fn import_persons_external(
 
     cmd.arg(url);
 
+    eprintln!(
+        "External import request: GET {} | client_cert={:?} ca={:?} api_key={}",
+        url,
+        state.external_client_cert_file,
+        state.external_ca_cert_file,
+        if state.external_persons_api_key.is_some() { "[set]" } else { "[not set]" }
+    );
+
     let output = cmd.output().await.map_err(|err| {
         eprintln!("Failed to execute curl: {err:?}");
         ApiError::internal("Kunde inte starta HTTP-klient (curl).")
     })?;
 
+    {
+        let verbose = String::from_utf8_lossy(&output.stderr);
+        let masked = match state.external_persons_api_key.as_deref() {
+            Some(key) => verbose.replace(key, "[REDACTED]").into(),
+            None => verbose.to_string(),
+        };
+        eprintln!("curl request/response log:\n{}", masked);
+    }
+
     if !output.status.success() {
         let stderr = String::from_utf8_lossy(&output.stderr);
         let stdout = String::from_utf8_lossy(&output.stdout);
@@ -114,10 +131,13 @@ pub async fn import_persons_external(
     let response: ExternalImportResponse = match serde_json::from_slice(&bytes) {
         Ok(res) => res,
         Err(err) => {
+            let preview = String::from_utf8_lossy(&bytes);
             eprintln!("Failed to parse external import JSON: {err:?}");
-            return Err(ApiError::internal(
-                "Kunde inte tolka data från extern källa.",
-            ));
+            eprintln!("Raw response ({} bytes): {}", bytes.len(), &preview[..preview.len().min(1000)]);
+            return Err(ApiError::internal(format!(
+                "Kunde inte tolka data från extern källa. Svar: {}",
+                preview.chars().take(300).collect::<String>()
+            )));
         }
     };
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 0186f7a..8ad5354 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -33,7 +33,7 @@ services:
       EXTERNAL_CA_CERT_FILE: ${EXTERNAL_CA_CERT_FILE:-}
       EXTERNAL_DANGER_ACCEPT_INVALID_CERTS: ${EXTERNAL_DANGER_ACCEPT_INVALID_CERTS:-false}
     volumes:
-      - ./certs:/app/certs:ro
+      - ./certs:/app/certs:ro,z
     depends_on:
       db:
         condition: service_healthy
diff --git a/web/src/lib/client/person-utils.ts b/web/src/lib/client/person-utils.ts
index a1236ba..225f66d 100644
--- a/web/src/lib/client/person-utils.ts
+++ b/web/src/lib/client/person-utils.ts
@@ -24,7 +24,9 @@ export function isLowerGrade(person: Person): boolean {
 }
 
 export function gradeLabel(person: Person): string {
-	return person.grade != null ? String(person.grade) : '–';
+	if (person.grade == null) return '–';
+	if (person.grade >= 10 && person.grade <= 12) return `Gymnasiet ${person.grade - 9}`;
+	return String(person.grade);
 }
 
 export function guardianLabel(person: Person): string {