diff --git a/cmd/wails-release/main.go b/cmd/wails-release/main.go
index 0ca73fe..9525ec1 100644
--- a/cmd/wails-release/main.go
+++ b/cmd/wails-release/main.go
@@ -189,8 +189,12 @@ func run(ctx context.Context) error {
 	return nil
 }
 
+// maskSecrets registers every credential value with the runner's log
+// scrubber via ::add-mask:: directives. These directives MUST be written
+// to stdout (not stderr) — the runner's command-parser only reads stdout.
 func maskSecrets(c *config.Config) {
 	for _, v := range []string{
+		c.DeveloperIDCertBase64,
 		c.DeveloperIDCertPassword,
 		c.NotarizationAPIKeyBase64,
 		c.NotarizationApplePassword,