diff --git a/actions/setup/js/git_auth_helpers.cjs b/actions/setup/js/git_auth_helpers.cjs
index da3c2717c31..b2d00f5a7da 100644
--- a/actions/setup/js/git_auth_helpers.cjs
+++ b/actions/setup/js/git_auth_helpers.cjs
@@ -210,6 +210,7 @@ async function overridePersistedExtraheader(serverUrl, token, cwd) {
   }
   core.info(`git_auth_helpers: overriding http.${normalizedUrl}/.extraheader with CI trigger token`);
   const tokenBase64 = Buffer.from(`x-access-token:${token.trim()}`).toString("base64");
+  core.setSecret(tokenBase64);
   const authHeader = `Authorization: basic ${tokenBase64}`;
 
   // Clear from ALL writable scopes before writing our token to prevent duplicate
diff --git a/actions/setup/js/git_auth_helpers.integration.test.cjs b/actions/setup/js/git_auth_helpers.integration.test.cjs
index 3fa70aa8c77..9eb340d3b07 100644
--- a/actions/setup/js/git_auth_helpers.integration.test.cjs
+++ b/actions/setup/js/git_auth_helpers.integration.test.cjs
@@ -130,6 +130,7 @@ describe("git_auth_helpers.cjs git integration", () => {
     mockCore = {
       info: vi.fn(),
       warning: vi.fn(),
+      setSecret: vi.fn(),
     };
 
     global.core = mockCore;
diff --git a/actions/setup/js/git_auth_helpers.test.cjs b/actions/setup/js/git_auth_helpers.test.cjs
index 9f6608d7b17..148aa0cb7d8 100644
--- a/actions/setup/js/git_auth_helpers.test.cjs
+++ b/actions/setup/js/git_auth_helpers.test.cjs
@@ -230,6 +230,15 @@ describe("git_auth_helpers.cjs", () => {
       }
     });
 
+    it("should register the base64 token with core.setSecret for runner-side masking", async () => {
+      const token = "ghp_test_token";
+      const expectedBase64 = Buffer.from(`x-access-token:${token}`).toString("base64");
+
+      await overridePersistedExtraheader(SERVER_URL, token);
+
+      expect(mockCore.setSecret).toHaveBeenCalledWith(expectedBase64);
+    });
+
     it("should return empty array when no previous extraheader exists", async () => {
       mockExec.getExecOutput.mockImplementation(async (_cmd, args) => {
         // Only the --get-all read returns empty; unset-all calls use ignoreReturnCode