diff --git a/pkg/downloader/chart_downloader.go b/pkg/downloader/chart_downloader.go
index 00c8c56e8..7ede44c51 100644
--- a/pkg/downloader/chart_downloader.go
+++ b/pkg/downloader/chart_downloader.go
@@ -246,22 +246,31 @@ func (c *ChartDownloader) DownloadToCache(ref, version string) (string, *provena
 	if len(digest) == 0 || err != nil {
 		slog.Debug("attempting to download chart", "ref", ref, "version", version)
 		if err != nil && !os.IsNotExist(err) {
+			slog.Error("failed to access chart cache", "error", err, "ref", ref, "version", version)
 			return "", nil, err
 		}
 
 		// Get file not in the cache
 		data, gerr := g.Get(u.String(), c.Options...)
 		if gerr != nil {
+			slog.Error("failed to download chart from remote", "error", gerr, "url", u.String(), "ref", ref, "version", version)
 			return "", nil, gerr
 		}
 
 		// Generate the digest
 		if len(digest) == 0 {
-			digest32 = sha256.Sum256(data.Bytes())
+			// Defensive: check data.Bytes() is not nil/empty
+			bytes := data.Bytes()
+			if len(bytes) == 0 {
+				slog.Error("downloaded chart data is empty", "url", u.String(), "ref", ref, "version", version)
+				return "", nil, errors.New("downloaded chart data is empty")
+			}
+			digest32 = sha256.Sum256(bytes)
 		}
 
 		pth, err = c.Cache.Put(digest32, data, CacheChart)
 		if err != nil {
+			slog.Error("failed to put chart in cache", "error", err, "cache_id", hex.EncodeToString(digest32[:]))
 			return "", nil, err
 		}
 		slog.Debug("put downloaded chart in cache", "id", hex.EncodeToString(digest32[:]))