diff --git a/.changes/acl-identifier-error-context.md b/.changes/acl-identifier-error-context.md
new file mode 100644
index 000000000000..0918e9266fcd
--- /dev/null
+++ b/.changes/acl-identifier-error-context.md
@@ -0,0 +1,9 @@
+---
+"tauri-utils": "patch:enhance"
+---
+
+Improve diagnostics for invalid plugin and permission identifiers.
+
+The `Identifier` deserializer now wraps the inner error with the offending identifier string so the message reads `invalid plugin or permission identifier '<value>': ...`, surfacing the bad entry without requiring a grep through the file.
+
+The previous parse failure (`failed to parse JSON: identifiers can only include lowercase ASCII, hyphens which are not leading or trailing, and a single colon if using a prefix at line 16 column 23`) now reads `failed to parse JSON: invalid plugin or permission identifier 'sqlite_proxy:allow-foo': identifiers can only include lowercase ASCII, hyphens which are not leading or trailing, and a single colon if using a prefix at line 16 column 23`.
diff --git a/crates/tauri-utils/src/acl/identifier.rs b/crates/tauri-utils/src/acl/identifier.rs
index 7b9f90f2f4fd..72a7ec2f359c 100644
--- a/crates/tauri-utils/src/acl/identifier.rs
+++ b/crates/tauri-utils/src/acl/identifier.rs
@@ -216,7 +216,12 @@ impl<'de> Deserialize<'de> for Identifier {
   where
     D: Deserializer<'de>,
   {
-    Self::try_from(String::deserialize(deserializer)?).map_err(serde::de::Error::custom)
+    let raw = String::deserialize(deserializer)?;
+    Self::try_from(raw.clone()).map_err(|e| {
+      serde::de::Error::custom(format!(
+        "invalid plugin or permission identifier '{raw}': {e}"
+      ))
+    })
   }
 }