diff --git a/internal/apps/flared/frpc/manager.go b/internal/apps/flared/frpc/manager.go
index abc4a127..2b0c9598 100644
--- a/internal/apps/flared/frpc/manager.go
+++ b/internal/apps/flared/frpc/manager.go
@@ -192,6 +192,8 @@ func (m *Manager) restartProcess(ctx context.Context, relayID string, configPath
 			ensureNoOrphanProcess(pidPath)
 
 			cmd := exec.CommandContext(procCtx, m.cfg.FrpcPath, "-c", configPath) //nolint:gosec // FrpcPath and configPath are managed trusted locations
+			var stderrBuf bytes.Buffer
+			cmd.Stderr = &stderrBuf
 
 			m.mu.Lock()
 			proc.Cmd = cmd
@@ -213,10 +215,15 @@ func (m *Manager) restartProcess(ctx context.Context, relayID string, configPath
 				return
 			}
 
+			stderrOutput := strings.TrimSpace(stderrBuf.String())
 			if err != nil {
 				proc.LastError = err.Error()
 				proc.Status = "error"
-				slog.Error("frpc process exited unexpectedly", "relay_id", relayID, "error", err)
+				if stderrOutput != "" {
+					slog.Error("frpc process exited unexpectedly", "relay_id", relayID, "error", err, "stderr", stderrOutput)
+				} else {
+					slog.Error("frpc process exited unexpectedly", "relay_id", relayID, "error", err)
+				}
 			} else {
 				proc.Status = "stopped"
 				proc.LastError = "exited unexpectedly with code 0"
diff --git a/internal/apps/openflare/websocket/read_pump.go b/internal/apps/openflare/websocket/read_pump.go
index d8da94e8..829ae330 100644
--- a/internal/apps/openflare/websocket/read_pump.go
+++ b/internal/apps/openflare/websocket/read_pump.go
@@ -42,6 +42,13 @@ func runReadPump(
 		case messageTypePing:
 			_ = sendPong(nodeID)
 		case clientPongType:
+			// Refresh read deadline when the client replies with a JSON pong.
+			// This keeps the connection alive when the WebSocket is proxied
+			// through Cloudflare, which enforces a 100-second idle timeout on
+			// the TCP stream. Without this refresh, the server's 90-second read
+			// deadline expires and terminates the connection even though the
+			// client is actively responding to pings.
+			_ = conn.SetReadDeadline(time.Now().Add(wsReadDeadline))
 		default:
 			slog.Debug(logLabel+" unsupported message", "node_id", nodeID, "type", message.Type)
 		}