diff --git a/NEWS b/NEWS
index 3f5de9b9..dba32ba9 100644
--- a/NEWS
+++ b/NEWS
@@ -1,4 +1,5 @@
 2.1.5.dev0
+ * #1289: Add mutual TLS support for the Loki monitoring hook.
  * #1292: Fix a "source directories do not exist" regression when configuration paths are relative
    symlinks and the bootstrap data source hook is enabled.
  * #1294: Fix a regression in which SSH warnings from remote repositories broke the "spot" check.
diff --git a/borgmatic/hooks/monitoring/loki.py b/borgmatic/hooks/monitoring/loki.py
index 0bde9915..23a62a2b 100644
--- a/borgmatic/hooks/monitoring/loki.py
+++ b/borgmatic/hooks/monitoring/loki.py
@@ -152,9 +152,6 @@ def initialize_monitor(hook_config, config, config_filename, monitoring_log_leve
     tls = hook_config.get('tls', {})
 
     if bool(tls.get('cert_path')) != bool(tls.get('key_path')):
-        logger.critical(
-            'Invalid Loki TLS configuration: cert_path and key_path must both be set or both be unset'
-        )
         raise ValueError(
             'Invalid Loki TLS configuration: cert_path and key_path must both be set or both be unset'
         )
diff --git a/docs/reference/configuration/monitoring/loki.md b/docs/reference/configuration/monitoring/loki.md
index 1ee54fd4..599a9ccd 100644
--- a/docs/reference/configuration/monitoring/loki.md
+++ b/docs/reference/configuration/monitoring/loki.md
@@ -93,11 +93,16 @@ defaults for these flags in your borgmatic configuration via the
 
 ### Mutual TLS authentication
 
-<span class="minilink minilink-addedin">New in version **TBD**</span> Since
-Loki does not come with a built-in authentication layer [(doc)](https://grafana.com/docs/loki/latest/operations/authentication/), this feature is typically used
-alongside a reverse proxy (such as [nginx](https://docs.nginx.com/waf/configure/secure-mtls/) or
-[Traefik](https://doc.traefik.io/traefik/reference/routing-configuration/http/tls/tls-options/#client-authentication-mtls)) that handles mTLS termination.
-If your setup is configured for mTLS authentication, you can provide a client certificate and private key:
+<span class="minilink minilink-addedin">New in version 2.1.5</span> Since Loki
+does not come with a built-in authentication layer
+[(doc)](https://grafana.com/docs/loki/latest/operations/authentication/), this
+feature is typically used alongside a reverse proxy (such as
+[nginx](https://docs.nginx.com/waf/configure/secure-mtls/) or
+[Traefik](https://doc.traefik.io/traefik/reference/routing-configuration/http/tls/tls-options/#client-authentication-mtls))
+that handles mTLS termination.
+
+If your setup is configured for mTLS authentication, you can provide a client
+certificate and private key:
 
 ```yaml
 loki:
@@ -111,5 +116,7 @@ loki:
         key_path: /etc/borgmatic/loki-client.key
 ```
 
-Both `cert_path` and `key_path` must be [PEM-encoded](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail). They are passed directly
-to the underlying HTTP client, so the standard mutual TLS handshake is performed for every request borgmatic sends to Loki.
+Both `cert_path` and `key_path` must be
+[PEM-encoded](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail). They are
+passed directly to the underlying HTTP client, so the standard mutual TLS
+handshake is performed for every request borgmatic sends to Loki.