diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 747e0beaf..ab7a27111 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -137,8 +137,8 @@ jobs:
     outputs:
           api-token: ${{ steps.mint-token.outputs.api-token}}
     permissions:
-      contents: write
-      id-token: write      
+      id-token: write
+      contents: write   
     needs: [build-artifacts, test-artifact-install, test-artifact-use]
    
     steps:
@@ -206,4 +206,5 @@ jobs:
         run: |
           mkdir dist
           cp lava* dist/.
+          echo "::add-mask::${{ steps.mint-token.outputs.api-token }}"
           poetry publish -u __token__ -p '${{ steps.mint-token.outputs.api-token }}'