diff --git a/ocaml/xapi/message_forwarding.ml b/ocaml/xapi/message_forwarding.ml
index d1773e4f0c6..b52aaaa20ec 100644
--- a/ocaml/xapi/message_forwarding.ml
+++ b/ocaml/xapi/message_forwarding.ml
@@ -143,24 +143,15 @@ let do_op_on_common ~local_fn ~__context ~host ~remote_fn f =
       let task_opt = set_forwarding_on_task ~__context ~host in
       f __context host task_opt remote_fn
   with
-  | Xmlrpc_client.Connection_reset | Http_client.Http_request_rejected _ ->
-      warn
-        "Caught Connection_reset when contacting host %s; converting into \
-         CANNOT_CONTACT_HOST"
-        (Ref.string_of host) ;
-      raise
-        (Api_errors.Server_error
-           (Api_errors.cannot_contact_host, [Ref.string_of host])
-        )
-  | Xmlrpc_client.Stunnel_connection_failed ->
-      warn
-        "Caught Stunnel_connection_failed while contacting host %s; converting \
-         into CANNOT_CONTACT_HOST"
-        (Ref.string_of host) ;
-      raise
-        (Api_errors.Server_error
-           (Api_errors.cannot_contact_host, [Ref.string_of host])
-        )
+  | ( Xmlrpc_client.Connection_reset
+    | Http_client.Http_request_rejected _
+    | Xmlrpc_client.Stunnel_connection_failed ) as e
+  ->
+    error
+      "%s: Caught %s when contacting host %s; converting into \
+       CANNOT_CONTACT_HOST"
+      __FUNCTION__ (Printexc.to_string e) (Ref.string_of host) ;
+    raise Api_errors.(Server_error (cannot_contact_host, [Ref.string_of host]))
 
 (* regular forwarding fn, with session and live-check. Used by most calls, will
    use the connection cache. *)
diff --git a/ocaml/xapi/workload_balancing.ml b/ocaml/xapi/workload_balancing.ml
index 27fa184da84..7108032dbf7 100644
--- a/ocaml/xapi/workload_balancing.ml
+++ b/ocaml/xapi/workload_balancing.ml
@@ -329,8 +329,19 @@ let wlb_request ~__context ~host ~port ~auth ~meth ~params ~handler ~enable_log
   with
   | Remote_requests.Timed_out ->
       raise_timeout timeout
-  | Http_client.Http_request_rejected _ | Http_client.Http_error _ ->
-      raise_authentication_failed ()
+  | Http_client.Http_error (code, _) as e -> (
+      error "%s: Caught %s when contacting WLB" __FUNCTION__
+        (Printexc.to_string e) ;
+      match code with
+      | "401" | "403" ->
+          raise_authentication_failed ()
+      | _ ->
+          raise_connection_reset ()
+    )
+  | Http_client.Http_request_rejected _ as e ->
+      error "%s: Caught %s when contacting WLB" __FUNCTION__
+        (Printexc.to_string e) ;
+      raise_connection_reset ()
   | Xmlrpc_client.Connection_reset ->
       raise_connection_reset ()
   | Stunnel.Stunnel_verify_error reason ->