diff --git a/connect-vpn/action.yml b/connect-vpn/action.yml
index 81482f9..aa7ccea 100644
--- a/connect-vpn/action.yml
+++ b/connect-vpn/action.yml
@@ -34,6 +34,10 @@ inputs:
     default: "form"
     description: >
       호환성용 입력. 현재 웹 로그인 방식은 password 단계 후 OTP를 ga_code_attempt 폼에 별도 제출합니다.
+  debug-otp:
+    required: false
+    default: "false"
+    description: "true면 seed 검증용으로 생성된 OTP를 로그에 출력합니다. 확인 후 즉시 false로 되돌리세요."
 
   resource-name:
     required: false
@@ -109,6 +113,7 @@ runs:
         VPN_PASS: ${{ inputs.vpn-password }}
         OTP_SEED: ${{ inputs.otp-seed }}
         OTP_SEED_FORMAT: ${{ inputs.otp-seed-format }}
+        DEBUG_OTP: ${{ inputs.debug-otp }}
         RESOURCE_NAME: ${{ inputs.resource-name }}
         TIMEOUT: ${{ inputs.timeout }}
       run: |
@@ -228,11 +233,15 @@ runs:
 
         for otp_offset in 0 -1 1; do
           echo "OTP 제출 시도 (time-window offset=${otp_offset})"
+          OTP_CODE="$(totp "$otp_offset")"
+          if [ "$DEBUG_OTP" = "true" ]; then
+            echo "DEBUG generated OTP offset=${otp_offset}: ${OTP_CODE} (unix-time=$(date +%s))"
+          fi
           rm -f "$TOKEN_HEADERS" "$WORKDIR/04-token.body"
 
           curl_common -L -b "$COOKIE_JAR" -c "$COOKIE_JAR" \
             -X POST "$VPN_HOST/my.policy" \
-            --data-urlencode "ga_code_attempt=$(totp "$otp_offset")" \
+            --data-urlencode "ga_code_attempt=$OTP_CODE" \
             --data-urlencode "vhost=standard" \
             -o "$WORKDIR/03-webtop-${otp_offset}.html"