diff --git a/secrets/install.sh b/secrets/install.sh
index b885bd1..78db6fb 100755
--- a/secrets/install.sh
+++ b/secrets/install.sh
@@ -81,6 +81,14 @@ ask() {
   printf '%s' "${_ans:-$2}"
 }
 
+# mask <secret> — first 10 and last 10 characters plus the length, so a
+# truncated or doubled paste is visible without printing the whole token.
+mask() {
+  printf '%s' "$1" | awk '{ n = length($0)
+    if (n <= 20) printf "%s (%d chars)", "(too short)", n
+    else printf "%s**%s (%d chars)", substr($0, 1, 10), substr($0, n - 9), n }'
+}
+
 if [ -z "$OP_SERVICE_ACCOUNT_TOKEN" ] && [ -f "$SECRETS_ENV" ]; then
   say "secrets: no service-account token; keeping existing $SECRETS_ENV."
   exit 0
@@ -95,8 +103,10 @@ while :; do
     op whoami >/dev/null 2>&1 && break
     if [ "$_tries" -eq 0 ]; then
       say "secrets: 1Password REJECTED the service-account token $_token_src (bad paste, revoked or expired?)."
+      say "         token: $(mask "$OP_SERVICE_ACCOUNT_TOKEN")"
     else
       say "secrets: 1Password REJECTED that token — most likely a truncated or bad paste."
+      say "         token: $(mask "$OP_SERVICE_ACCOUNT_TOKEN")"
     fi
   fi
   if ! have_tty; then
@@ -118,7 +128,7 @@ while :; do
   OP_SERVICE_ACCOUNT_TOKEN="$(printf '%s' "$OP_SERVICE_ACCOUNT_TOKEN" | tr -d ' \t\r\n')"
   [ -n "$OP_SERVICE_ACCOUNT_TOKEN" ] || say "secrets: no token entered."
 done
-say "secrets: service-account token OK."
+say "secrets: service-account token OK: $(mask "$OP_SERVICE_ACCOUNT_TOKEN")"
 
 # pick <kind> <current> <default> <check-fn> <list-cmd...>
 # Resolve a vault or item name: keep <current> if it checks out; otherwise use