diff --git a/distro-packages/Arch-Linux/skald-git/PKGBUILD b/distro-packages/Arch-Linux/skald-git/PKGBUILD
index 01febac..984777c 100644
--- a/distro-packages/Arch-Linux/skald-git/PKGBUILD
+++ b/distro-packages/Arch-Linux/skald-git/PKGBUILD
@@ -2,7 +2,7 @@
 # shellcheck shell=bash disable=SC2034,SC2154
 
 pkgname=skald-git
-pkgver=0.0.0.r1547.g506c053
+pkgver=0.0.0.r1551.g4e210db
 pkgrel=1
 pkgdesc='Audio-only hall-based conferencing server'
 arch=('x86_64' 'aarch64')
diff --git a/webserver/api.go b/webserver/api.go
index 6bb2adc..a3cebf0 100644
--- a/webserver/api.go
+++ b/webserver/api.go
@@ -25,7 +25,8 @@ func checkAdmin(w http.ResponseWriter, r *http.Request) bool {
 		ok, _ = adminMatch(username, password)
 	}
 	if !ok {
-		failAuthentication(w, "/skald-api/")
+		failAuthentication(w, "/skald-api/",
+			"Authentication required. Provide valid administrator credentials.")
 		return false
 	}
 	return true
@@ -71,7 +72,8 @@ func checkPasswordAdmin(w http.ResponseWriter, r *http.Request, hallname, user s
 			}
 		}
 	}
-	failAuthentication(w, "/skald-api/")
+	failAuthentication(w, "/skald-api/",
+		"Authentication required. Provide valid administrator credentials.")
 	return false
 }
 
diff --git a/webserver/webserver.go b/webserver/webserver.go
index 43202a4..7845437 100644
--- a/webserver/webserver.go
+++ b/webserver/webserver.go
@@ -505,10 +505,10 @@ func adminMatch(username, password string) (bool, error) {
 	return false, nil
 }
 
-func failAuthentication(w http.ResponseWriter, realm string) {
+func failAuthentication(w http.ResponseWriter, realm string, message string) {
 	w.Header().Set("www-authenticate",
 		fmt.Sprintf("basic realm=\"%v\"", realm))
-	http.Error(w, "Haha!", http.StatusUnauthorized)
+	http.Error(w, message, http.StatusUnauthorized)
 }
 
 func CheckOrigin(w http.ResponseWriter, r *http.Request, admin bool) bool {
@@ -654,7 +654,8 @@ func recordingsHandler(w http.ResponseWriter, r *http.Request) {
 
 	ok := checkHallPermissions(w, r, hall)
 	if !ok {
-		failAuthentication(w, "recordings/"+hall)
+		failAuthentication(w, "recordings/"+hall,
+			"Authentication required to access recordings. Provide valid credentials with recording permission.")
 		return
 	}
 
diff --git a/webserver/webserver_test.go b/webserver/webserver_test.go
index f861ac5..7d99dd9 100644
--- a/webserver/webserver_test.go
+++ b/webserver/webserver_test.go
@@ -4,8 +4,10 @@ import (
 	"crypto/tls"
 	"encoding/json"
 	"net/http"
+	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/pion/webrtc/v4"
@@ -37,6 +39,26 @@ func TestParseHallName(t *testing.T) {
 	}
 }
 
+func TestRecordingsAuthenticationFailureMessage(t *testing.T) {
+	w := httptest.NewRecorder()
+
+	failAuthentication(w, "recordings/cavi",
+		"Authentication required to access recordings. Provide valid credentials with recording permission.")
+
+	resp := w.Result()
+	if resp.StatusCode != http.StatusUnauthorized {
+		t.Fatalf("status = %d, expected %d",
+			resp.StatusCode, http.StatusUnauthorized)
+	}
+	if got := resp.Header.Get("www-authenticate"); got != `basic realm="recordings/cavi"` {
+		t.Fatalf("www-authenticate = %q", got)
+	}
+	if body := w.Body.String(); !strings.Contains(body,
+		"Authentication required to access recordings. Provide valid credentials with recording permission.") {
+		t.Fatalf("body = %q", body)
+	}
+}
+
 func TestBase(t *testing.T) {
 	a := []struct {
 		p      string