diff --git a/coderd/audit.go b/coderd/audit.go
index 54f1791589..ba29ace95b 100644
--- a/coderd/audit.go
+++ b/coderd/audit.go
@@ -180,8 +180,9 @@ func (api *API) convertAuditLogs(ctx context.Context, dblogs []database.GetAudit
 }
 
 type AdditionalFields struct {
-	WorkspaceName string
-	BuildNumber   string
+	WorkspaceName string               `json:"workspace_name"`
+	BuildNumber   string               `json:"build_number"`
+	BuildReason   database.BuildReason `json:"build_reason"`
 }
 
 func (api *API) convertAuditLog(ctx context.Context, dblog database.GetAuditLogsOffsetRow) codersdk.AuditLog {
@@ -219,6 +220,7 @@ func (api *API) convertAuditLog(ctx context.Context, dblog database.GetAuditLogs
 		resourceInfo := map[string]string{
 			"workspaceName": "unknown",
 			"buildNumber":   "unknown",
+			"buildReason":   "unknown",
 		}
 		dblog.AdditionalFields, err = json.Marshal(resourceInfo)
 		api.Logger.Error(ctx, "marshal additional fields", slog.Error(err))
@@ -262,8 +264,8 @@ func auditLogDescription(alog database.GetAuditLogsOffsetRow, additionalFields A
 	)
 
 	// Strings for starting/stopping workspace builds follow the below format:
-	// "{user} started build #{build_number} for workspace {target}"
-	// where target is a workspace instead of a workspace build
+	// "{user | 'Coder automatically'} started build #{build_number} for workspace {target}"
+	// where target is a workspace (name) instead of a workspace build
 	// passed in on the FE via AuditLog.AdditionalFields rather than derived in request.go:35
 	if alog.ResourceType == database.ResourceTypeWorkspaceBuild && alog.Action != database.AuditActionDelete {
 		if len(additionalFields.BuildNumber) == 0 {
diff --git a/coderd/provisionerdserver/provisionerdserver.go b/coderd/provisionerdserver/provisionerdserver.go
index 2e8a0adf75..9974338ffb 100644
--- a/coderd/provisionerdserver/provisionerdserver.go
+++ b/coderd/provisionerdserver/provisionerdserver.go
@@ -550,6 +550,7 @@ func (server *Server) FailJob(ctx context.Context, failJob *proto.FailedJob) (*p
 				buildResourceInfo := map[string]string{
 					"workspaceName": workspace.Name,
 					"buildNumber":   strconv.FormatInt(int64(build.BuildNumber), 10),
+					"buildReason":   fmt.Sprintf("%v", build.Reason),
 				}
 
 				wriBytes, err := json.Marshal(buildResourceInfo)
@@ -799,6 +800,7 @@ func (server *Server) CompleteJob(ctx context.Context, completed *proto.Complete
 			buildResourceInfo := map[string]string{
 				"workspaceName": workspace.Name,
 				"buildNumber":   strconv.FormatInt(int64(workspaceBuild.BuildNumber), 10),
+				"buildReason":   fmt.Sprintf("%v", workspaceBuild.Reason),
 			}
 
 			wriBytes, err := json.Marshal(buildResourceInfo)
diff --git a/site/src/components/AuditLogRow/AuditLogDescription.tsx b/site/src/components/AuditLogRow/AuditLogDescription.tsx
index 38382f96ff..58eb4926b5 100644
--- a/site/src/components/AuditLogRow/AuditLogDescription.tsx
+++ b/site/src/components/AuditLogRow/AuditLogDescription.tsx
@@ -12,10 +12,17 @@ export const AuditLogDescription: FC<{ auditLog: AuditLog }> = ({
   const { t } = i18next
 
   let target = auditLog.resource_target.trim()
+  let user = auditLog.user?.username.trim()
 
-  // audit logs with a resource_type of workspace build use workspace name as a target
   if (auditLog.resource_type === "workspace_build") {
+    // audit logs with a resource_type of workspace build use workspace name as a target
     target = auditLog.additional_fields.workspaceName.trim()
+    // workspaces can be started/stopped by a user, or kicked off automatically by Coder
+    user =
+      auditLog.additional_fields.buildReason &&
+      auditLog.additional_fields.buildReason !== "initiator"
+        ? t("auditLog:table.logRow.buildReason")
+        : auditLog.user?.username.trim()
   }
 
   // SSH key entries have no links
@@ -30,7 +37,7 @@ export const AuditLogDescription: FC<{ auditLog: AuditLog }> = ({
   }
 
   const truncatedDescription = auditLog.description
-    .replace("{user}", `${auditLog.user?.username.trim()}`)
+    .replace("{user}", `${user}`)
     .replace("{target}", "")
 
   return (
diff --git a/site/src/i18n/en/auditLog.json b/site/src/i18n/en/auditLog.json
index d4cd519a68..c0b9c5864d 100644
--- a/site/src/i18n/en/auditLog.json
+++ b/site/src/i18n/en/auditLog.json
@@ -13,7 +13,8 @@
       "os": "OS: ",
       "browser": "Browser: ",
       "notAvailable": "Not available",
-      "onBehalfOf": " on behalf of {{owner}}"
+      "onBehalfOf": " on behalf of {{owner}}",
+      "buildReason": "Coder automatically"
     }
   },
   "paywall": {