diff --git a/src/cork.rs b/src/cork.rs
index 7863bdf8..ac912265 100644
--- a/src/cork.rs
+++ b/src/cork.rs
@@ -158,11 +158,23 @@ async fn handle_cork(cellar_id: &str, encoded_call: Vec<u8>, height: u64) -> Res
                     "failed to schedule cork for cellar {}. code {}, raw log: {}",
                     cellar_id, res.code, res.raw_log
                 );
-                return Err(Status::new(
-                    Code::Internal,
+                // Sommelier v10 retired the validator-delegate cork path: the
+                // chain requires signer == params.cork_authority. A rejection
+                // here is far more likely to be that than a local misconfig,
+                // and the generic message sent operators looking in the wrong
+                // place, so name the likely cause explicitly.
+                let hint = if res.raw_log.contains("not the cork authority")
+                    || res.raw_log.contains("unauthorized")
+                {
+                    "this steward's delegate key is not the chain's cork_authority. \
+                     Since Sommelier v10 only that address may schedule corks; steward \
+                     cannot sign for an authority held on a hardware wallet. Schedule it \
+                     with: sommelier tx cork schedule-cork <cellar> <height> <hex-call> \
+                     --from <authority>"
+                } else {
                     "cork submission failed. this may be a steward configuration problem."
-                        .to_string(),
-                ));
+                };
+                return Err(Status::new(Code::Internal, hint.to_string()));
             }
 
             debug!("cork response: {:?}", res);
diff --git a/src/somm_send.rs b/src/somm_send.rs
index ac9f781b..b0b2d5d7 100644
--- a/src/somm_send.rs
+++ b/src/somm_send.rs
@@ -80,6 +80,21 @@ pub async fn unsubscribe(cellar_id: String) -> Result<TxResponse, CosmosGrpcErro
     send_messages(vec![msg]).await
 }
 
+/// Schedule a cork against an Ethereum cellar.
+///
+/// NOTE (Sommelier v10): the chain no longer accepts corks from a validator's
+/// delegate key. x/cork's msg server requires
+/// `signer == params.cork_authority`, with no fallback to the retired
+/// validator-supermajority path, so this call fails with ErrUnauthorized unless
+/// steward's delegate key IS the cork authority.
+///
+/// Steward loads its signing key from an on-disk FsKeyStore, so it cannot act
+/// as an authority held on a hardware wallet. Where that is the case, schedule
+/// corks with the CLI instead:
+///
+/// ```text
+/// sommelier tx cork schedule-cork <cellar> <height> <hex-call> --from <authority>
+/// ```
 pub async fn schedule_cork(cork: Cork, block_height: u64) -> Result<TxResponse, CosmosGrpcError> {
     let msg = MsgScheduleCorkRequest {
         cork: Some(cork),