diff --git a/site/src/pages/AuditPage/AuditLogRow/AuditLogDescription/AuditLogDescription.stories.tsx b/site/src/pages/AuditPage/AuditLogRow/AuditLogDescription/AuditLogDescription.stories.tsx
index dd2c88f5be50b..99d4f900ca0d6 100644
--- a/site/src/pages/AuditPage/AuditLogRow/AuditLogDescription/AuditLogDescription.stories.tsx
+++ b/site/src/pages/AuditPage/AuditLogRow/AuditLogDescription/AuditLogDescription.stories.tsx
@@ -105,3 +105,12 @@ export const SCIMUpdateUser: Story = {
 		},
 	},
 };
+
+export const UnauthenticatedUser: Story = {
+	args: {
+		auditLog: {
+			...MockAuditLog,
+			user: null,
+		},
+	},
+};
diff --git a/site/src/pages/AuditPage/AuditLogRow/AuditLogDescription/AuditLogDescription.tsx b/site/src/pages/AuditPage/AuditLogRow/AuditLogDescription/AuditLogDescription.tsx
index 4b2a9b4df4df7..ed105989f1f02 100644
--- a/site/src/pages/AuditPage/AuditLogRow/AuditLogDescription/AuditLogDescription.tsx
+++ b/site/src/pages/AuditPage/AuditLogRow/AuditLogDescription/AuditLogDescription.tsx
@@ -19,7 +19,9 @@ export const AuditLogDescription: FC<AuditLogDescriptionProps> = ({
 	}
 
 	let target = auditLog.resource_target.trim();
-	let user = auditLog.user?.username.trim();
+	let user = auditLog.user
+		? auditLog.user.username.trim()
+		: "Unauthenticated user";
 
 	// SSH key entries have no links
 	if (auditLog.resource_type === "git_ssh_key") {
diff --git a/site/src/pages/AuditPage/AuditLogRow/AuditLogDescription/BuildAuditDescription.tsx b/site/src/pages/AuditPage/AuditLogRow/AuditLogDescription/BuildAuditDescription.tsx
index ca610eb01f6a3..8e321d6e85334 100644
--- a/site/src/pages/AuditPage/AuditLogRow/AuditLogDescription/BuildAuditDescription.tsx
+++ b/site/src/pages/AuditPage/AuditLogRow/AuditLogDescription/BuildAuditDescription.tsx
@@ -16,7 +16,9 @@ export const BuildAuditDescription: FC<BuildAuditDescriptionProps> = ({
 		auditLog.additional_fields?.build_reason &&
 		auditLog.additional_fields?.build_reason !== "initiator"
 			? "Coder automatically"
-			: auditLog.user?.username.trim();
+			: auditLog.user
+				? auditLog.user.username.trim()
+				: "Unauthenticated user";
 
 	const action = useMemo(() => {
 		switch (auditLog.action) {