diff --git a/guarddog_nexus/routes/webhooks.py b/guarddog_nexus/routes/webhooks.py
index ccd8cb5..427d170 100644
--- a/guarddog_nexus/routes/webhooks.py
+++ b/guarddog_nexus/routes/webhooks.py
@@ -96,15 +96,24 @@ async def nexus_webhook(
     if action not in RELEVANT_WEBHOOK_ACTIONS:
         return {"status": WEBHOOK_STATUS_IGNORED, "action": action}
 
-    # Log full payload for debugging (to discover available fields)
-    log.info("Webhook payload: initiator=%s nodeId=%s keys=%s",
-             data.get("initiator"), data.get("nodeId"), sorted(data.keys()))
+    # Nexus sends initiator as "username/IP" — parse both fields
+    raw_initiator = data.get("initiator", "")
+    initiator = None
+    source_ip = None
+    if raw_initiator and "/" in raw_initiator:
+        parts = raw_initiator.rsplit("/", 1)
+        initiator = parts[0]
+        source_ip = parts[1]
+    elif raw_initiator:
+        initiator = raw_initiator
+        source_ip = request.client.host if request.client else None
+
+    log.info("Webhook: action=%s initiator=%s source_ip=%s",
+             action, initiator, source_ip)
 
     repository = data.get("repositoryName", "")
     asset = data.get("asset")
     component = data.get("component")
-    initiator = data.get("initiator")
-    source_ip = request.client.host if request.client else None
 
     if asset:
         asset_path = _extract_asset_path(asset)