diff --git a/vault_oidc_ssh_cert_action.py b/vault_oidc_ssh_cert_action.py
index f87514f..cc024d4 100644
--- a/vault_oidc_ssh_cert_action.py
+++ b/vault_oidc_ssh_cert_action.py
@@ -10,6 +10,10 @@ class VoscaError(Exception):
     pass
 
 
+def _mask_value(secret: str) -> None:
+    print(f"::add-mask::{secret}")
+
+
 def _set_error_message(title: str, message: str) -> None:
     print(f"::error title={title}::{message}")
 
@@ -105,7 +109,7 @@ def github_vault_auth() -> None:
         vault_server, oidc_backend, oidc_role, jwt_token
     )
 
-    print(f"::add-mask::{vault_token}")
+    _mask_value(vault_token)
     with open(os.environ["GITHUB_OUTPUT"], mode="a", encoding="utf-8") as ghof:
         ghof.write(f"vault_token={vault_token}\n")