diff --git a/.github/workflows/custom-release.yml b/.github/workflows/custom-release.yml
index bb12cd21e..e9e3f7208 100644
--- a/.github/workflows/custom-release.yml
+++ b/.github/workflows/custom-release.yml
@@ -56,6 +56,7 @@ jobs:
           certificate_path="$RUNNER_TEMP/developer-id-application.p12"
           previous_default_keychain="$(security default-keychain -d user 2>/dev/null | sed 's/[ "]//g' || true)"
 
+          echo "::add-mask::$keychain_password"
           echo "CUSTOM_RELEASE_KEYCHAIN_PATH=$keychain_path" >> "$GITHUB_ENV"
           echo "CUSTOM_RELEASE_KEYCHAIN_PASSWORD=$keychain_password" >> "$GITHUB_ENV"
           echo "CUSTOM_RELEASE_CERTIFICATE_PATH=$certificate_path" >> "$GITHUB_ENV"
diff --git a/scripts/tests/test-custom-release-macos-runner.bats b/scripts/tests/test-custom-release-macos-runner.bats
index f186219ae..4d5156daf 100644
--- a/scripts/tests/test-custom-release-macos-runner.bats
+++ b/scripts/tests/test-custom-release-macos-runner.bats
@@ -47,6 +47,9 @@ setup() {
 	run rg -n 'security import .* -P "\$DEVELOPER_ID_APPLICATION_P12_PASSWORD"' "$GITHUB_WORKFLOW"
 	[ "$status" -eq 0 ]
 
+	run rg -n '::add-mask::\$keychain_password' "$GITHUB_WORKFLOW"
+	[ "$status" -eq 0 ]
+
 	run rg -n 'if: always\(\)' "$GITHUB_WORKFLOW"
 	[ "$status" -eq 0 ]