diff --git a/cmd/jwker/main.go b/cmd/jwker/main.go
index 30de9c5..5b3ffa8 100644
--- a/cmd/jwker/main.go
+++ b/cmd/jwker/main.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"os"
+	"strings"
 	"time"
 
 	"github.com/go-logr/zapr"
@@ -50,21 +51,21 @@ func init() {
 }
 
 func main() {
-	zapLogger, err := setupZapLogger()
+	cfg, err := config.New()
 	if err != nil {
-		log.Fatalf("unable to set up logger: %+v", err)
+		setupLog.Error(err, "initializing config")
 		os.Exit(1)
 	}
 
-	ctrl.SetLogger(zapr.NewLogger(zapLogger))
-	setupLog.Info("starting jwker")
-
-	cfg, err := config.New()
+	zapLogger, err := setupZapLogger(cfg.LogLevel)
 	if err != nil {
-		setupLog.Error(err, "initializing config")
+		log.Fatalf("unable to set up logger: %+v", err)
 		os.Exit(1)
 	}
 
+	ctrl.SetLogger(zapr.NewLogger(zapLogger))
+	setupLog.Info("starting jwker")
+
 	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
 		Scheme:             scheme,
 		MetricsBindAddress: cfg.MetricsAddr,
@@ -99,9 +100,13 @@ func main() {
 	}
 }
 
-func setupZapLogger() (*zap.Logger, error) {
+func setupZapLogger(logLevel string) (*zap.Logger, error) {
 	loggerConfig := zap.NewProductionConfig()
-	loggerConfig.Level = zap.NewAtomicLevelAt(zap.DebugLevel)
+	level, err := zap.ParseAtomicLevel(strings.ToLower(logLevel))
+	if err != nil {
+		return nil, err
+	}
+	loggerConfig.Level = level
 	loggerConfig.EncoderConfig.TimeKey = "timestamp"
 	loggerConfig.EncoderConfig.EncodeTime = zapcore.RFC3339NanoTimeEncoder
 	return loggerConfig.Build()
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 6728a78..82d8875 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -15,6 +15,7 @@ import (
 type Config struct {
 	AuthProvider AuthProvider
 	ClusterName  string
+	LogLevel     string
 	MetricsAddr  string
 	Tokendings   Tokendings
 }
@@ -45,6 +46,7 @@ func New() (*Config, error) {
 	flag.StringVar(&cfg.MetricsAddr, "metrics-addr", ":8181", "The address the metric endpoint binds to.")
 	flag.StringVar(&cfg.Tokendings.BaseURL, "tokendings-base-url", os.Getenv("TOKENDINGS_URL"), "Base URL to Tokendings.")
 	flag.StringVar(&cfg.Tokendings.ClientID, "tokendings-client-id", os.Getenv("TOKENDINGS_CLIENT_ID"), "Client ID of Tokendings at Auth Provider")
+	flag.StringVar(&cfg.LogLevel, "log-level", "info", "Log level for jwker")
 	flag.Parse()
 
 	j, err := jwkutils.ParseJWK([]byte(clientJwkJson))