diff --git a/scripts/release-sign.js b/scripts/release-sign.js
index c9f375a..486f42e 100644
--- a/scripts/release-sign.js
+++ b/scripts/release-sign.js
@@ -65,7 +65,11 @@ const outDir = path.join(root, 'releases', version);
 fs.mkdirSync(outDir, { recursive: true });
 
 function run(cmd) {
-  console.log(`> ${cmd}`);
+  // Mask secrets in logs
+  let shown = cmd;
+  if (issuer) shown = shown.replaceAll(issuer, '***');
+  if (secret) shown = shown.replaceAll(secret, '***');
+  console.log(`> ${shown}`);
   execSync(cmd, { stdio: 'inherit' });
 }
 
@@ -79,7 +83,7 @@ try {
     '--channel=unlisted',
     `--api-key="${issuer}"`,
     `--api-secret="${secret}"`,
-    `--id="${addonId}"`,
+    // ID is read from manifest.json; newer web-ext may not support --id
     `--artifacts-dir "${outDir}"`,
   ].join(' ');
   run(signCmd);