diff --git a/hive-c0re/src/forge/users.rs b/hive-c0re/src/forge/users.rs
index 467c5dfe..0cf33712 100644
--- a/hive-c0re/src/forge/users.rs
+++ b/hive-c0re/src/forge/users.rs
@@ -304,8 +304,18 @@ async fn mint_token(name: &str, scopes: &str) -> Result<String> {
         scopes,
     ])
     .await?;
-    let token = extract_token(&stdout)
-        .with_context(|| format!("parse token from forgejo output: {stdout:?}"))?;
+    // Deliberately does NOT include `stdout`: on this path forgejo has
+    // already minted a live token and printed it, and an error string
+    // propagates into logs the same way any other message does. The
+    // shape of the output is enough to diagnose a version drift.
+    let token = extract_token(&stdout).with_context(|| {
+        format!(
+            "no token-shaped word (>= 32 hex chars) in forgejo output \
+             ({} bytes, {} lines); output withheld, it carries the token",
+            stdout.len(),
+            stdout.lines().count()
+        )
+    })?;
     tracing::debug!(%name, %token_name, "forge: minted access token");
     Ok(token)
 }