diff --git a/lib/cloud_controller/errands/check_database_key.rb b/lib/cloud_controller/errands/check_database_key.rb
index 257edee17f9..56cac32779c 100644
--- a/lib/cloud_controller/errands/check_database_key.rb
+++ b/lib/cloud_controller/errands/check_database_key.rb
@@ -30,10 +30,16 @@ def perform
       def count_rows_needing_rotation
         current_key_label = Encryptor.current_encryption_key_label
         Encryptor.encrypted_classes.sum do |klass|
-          klass.constantize.
-            exclude(encryption_key_label: current_key_label).
-            or(encryption_key_label: nil).
-            count
+          model = klass.constantize
+          rows = model.exclude(encryption_key_label: current_key_label).or(encryption_key_label: nil)
+          total = rows.count
+          if total > 0
+            rows.group_and_count(:encryption_key_label).each do |row|
+              label = row[:encryption_key_label].nil? ? '(nil)' : row[:encryption_key_label]
+              logger.debug("Table #{model.table_name}: #{row[:count]} row(s) with encryption_key_label=#{label}")
+            end
+          end
+          total
         end
       end
     end
diff --git a/spec/unit/lib/cloud_controller/errands/check_database_key_spec.rb b/spec/unit/lib/cloud_controller/errands/check_database_key_spec.rb
index ebc9b7ae4fc..bdb73966a88 100644
--- a/spec/unit/lib/cloud_controller/errands/check_database_key_spec.rb
+++ b/spec/unit/lib/cloud_controller/errands/check_database_key_spec.rb
@@ -3,7 +3,7 @@
 module VCAP::CloudController
   RSpec.describe CheckDatabaseKey do
     describe '#perform' do
-      let(:logger) { instance_double(Steno::Logger, info: nil, error: nil) }
+      let(:logger) { instance_double(Steno::Logger, info: nil, error: nil, debug: nil) }
 
       before do
         allow(Steno).to receive(:logger).and_return(logger)
@@ -30,8 +30,8 @@ module VCAP::CloudController
 
       context 'when all rows are encrypted with the current key' do
         before do
-          allow(AppModel).to receive(:exclude).and_return(double(or: double(count: 0)))
-          allow(TaskModel).to receive(:exclude).and_return(double(or: double(count: 0)))
+          allow(AppModel).to receive(:exclude).and_return(double(or: double(count: 0, group_and_count: [])))
+          allow(TaskModel).to receive(:exclude).and_return(double(or: double(count: 0, group_and_count: [])))
         end
 
         it 'exits with 0' do
@@ -68,6 +68,12 @@ module VCAP::CloudController
           expect { CheckDatabaseKey.perform }.to raise_error(SystemExit)
           expect(logger).to have_received(:info).with(a_string_matching(/\d+ row\(s\) need re-encryption with the current key/))
         end
+
+        it 'logs per-table and per-label breakdown at debug level' do
+          expect { CheckDatabaseKey.perform }.to raise_error(SystemExit)
+          expect(logger).to have_received(:debug).with(a_string_matching(/Table apps: \d+ row\(s\) with encryption_key_label=old/))
+          expect(logger).to have_received(:debug).with(a_string_matching(/Table tasks: \d+ row\(s\) with encryption_key_label=old/))
+        end
       end
 
       context 'when an unexpected error occurs' do