diff --git a/cmd/audit_logs.go b/cmd/audit_logs.go
index aa6bd85..aa5b308 100644
--- a/cmd/audit_logs.go
+++ b/cmd/audit_logs.go
@@ -112,7 +112,7 @@ func (c AuditLogsCmd) Search(ctx context.Context, in AuditLogsSearchInput) error
 		return nil
 	}
 
-	table := pterm.TableData{{"Timestamp", "Method", "Status", "Path", "User", "Duration (ms)", "Client IP"}}
+	table := pterm.TableData{{"Timestamp", "Method", "Status", "Path", "User", "User ID", "Duration (ms)", "Client IP"}}
 	for _, entry := range entries {
 		table = append(table, []string{
 			util.FormatLocal(entry.Timestamp),
@@ -120,6 +120,7 @@ func (c AuditLogsCmd) Search(ctx context.Context, in AuditLogsSearchInput) error
 			strconv.FormatInt(entry.Status, 10),
 			entry.Path,
 			formatAuditLogUser(entry),
+			entry.UserID,
 			strconv.FormatInt(entry.DurationMs, 10),
 			entry.ClientIP,
 		})
@@ -156,13 +157,10 @@ func parseAuditLogTime(value string) (time.Time, error) {
 }
 
 func formatAuditLogUser(entry kernel.AuditLogEntry) string {
-	if entry.Email != "" {
-		return entry.Email
+	if entry.Email == "" {
+		return "-"
 	}
-	if entry.UserID != "" {
-		return entry.UserID
-	}
-	return "-"
+	return entry.Email
 }
 
 func getAuditLogsHandler(cmd *cobra.Command) AuditLogsCmd {
diff --git a/cmd/audit_logs_test.go b/cmd/audit_logs_test.go
index 32a1d47..e574af1 100644
--- a/cmd/audit_logs_test.go
+++ b/cmd/audit_logs_test.go
@@ -88,9 +88,17 @@ func TestAuditLogsSearchBuildsParamsAndPrintsTable(t *testing.T) {
 	assert.Contains(t, out, "POST")
 	assert.Contains(t, out, "201")
 	assert.Contains(t, out, "dev@example.com")
+	assert.Contains(t, out, "user_123")
 	assert.Contains(t, out, "203.0.113.7")
 }
 
+func TestFormatAuditLogUserDoesNotRepeatUserIDWhenEmailMissing(t *testing.T) {
+	entry := sampleAuditLogEntry("POST", "/browsers")
+	entry.Email = ""
+
+	assert.Equal(t, "-", formatAuditLogUser(entry))
+}
+
 func TestAuditLogsSearchRejectsInvalidStart(t *testing.T) {
 	c := AuditLogsCmd{auditLogs: &FakeAuditLogsService{}}