diff --git a/src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitConfig.java b/src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitConfig.java
index 33e5382..33103fa 100644
--- a/src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitConfig.java
+++ b/src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitConfig.java
@@ -452,6 +452,26 @@ public class AuthentikQBitConfig implements QBitConfig
 
 
 
+   /*******************************************************************************
+    ** The features that are actually on: the configured set, plus TOKENS when it
+    ** is on by default (writes enabled, not opted out), minus TOKENS when it is
+    ** listed but off (read only or opted out). This is what hosts see in logs.
+    *******************************************************************************/
+   public java.util.Set<AuthentikFeature> getEffectiveFeatures()
+   {
+      java.util.EnumSet<AuthentikFeature> effective = java.util.EnumSet.noneOf(AuthentikFeature.class);
+      for(AuthentikFeature feature : AuthentikFeature.values())
+      {
+         if(hasFeature(feature))
+         {
+            effective.add(feature);
+         }
+      }
+      return (effective);
+   }
+
+
+
    /*******************************************************************************
     ** Whether a feature is enabled.
     *******************************************************************************/
diff --git a/src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitProducer.java b/src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitProducer.java
index 841755d..661f7cf 100644
--- a/src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitProducer.java
+++ b/src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitProducer.java
@@ -192,7 +192,7 @@ public class AuthentikQBitProducer implements QBitMetaDataProducer<AuthentikQBit
       }
 
       LOG.info("Authentik QBit produced", logPair("version", VERSION), logPair("appKey", qBitConfig.getAppKey()),
-         logPair("features", qBitConfig.getFeatures()), logPair("readOnly", qBitConfig.getReadOnly()));
+         logPair("features", qBitConfig.getEffectiveFeatures()), logPair("readOnly", qBitConfig.getReadOnly()));
       return (new MetaDataProducerMultiOutput());
    }
 
diff --git a/src/test/java/com/kingsrook/qbits/authentik/AuthentikQBitConfigTest.java b/src/test/java/com/kingsrook/qbits/authentik/AuthentikQBitConfigTest.java
index dd49b48..12cb9ef 100644
--- a/src/test/java/com/kingsrook/qbits/authentik/AuthentikQBitConfigTest.java
+++ b/src/test/java/com/kingsrook/qbits/authentik/AuthentikQBitConfigTest.java
@@ -236,4 +236,17 @@ class AuthentikQBitConfigTest
       assertThat(config.getTokenBrokerClientSecret()).isNull();
    }
 
+
+
+   /*******************************************************************************
+    ** The startup log lists TOKENS when it is on by default (writes enabled).
+    *******************************************************************************/
+   @org.junit.jupiter.api.Test
+   void effectiveFeaturesIncludeDefaultTokens()
+   {
+      AuthentikQBitConfig writes = new AuthentikQBitConfig().withFeatures(java.util.EnumSet.of(AuthentikFeature.READ, AuthentikFeature.USERS)).withTokensEnabled(true);
+      org.assertj.core.api.Assertions.assertThat(writes.getEffectiveFeatures()).contains(AuthentikFeature.TOKENS, AuthentikFeature.READ, AuthentikFeature.USERS);
+      AuthentikQBitConfig readOnly = new AuthentikQBitConfig().withFeatures(java.util.EnumSet.of(AuthentikFeature.READ));
+      org.assertj.core.api.Assertions.assertThat(readOnly.getEffectiveFeatures()).containsExactly(AuthentikFeature.READ);
+   }
 }