diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b465dab4..50058df2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -45,6 +45,12 @@ jobs:
     runs-on: [self-hosted, macOS]
 
     steps:
+      # The self-hosted runner lives under the machine owner's home
+      # directory; mask it first so absolute paths in every later step's
+      # output show up as *** in the public workflow logs.
+      - name: Mask runner paths
+        run: echo "::add-mask::$HOME"
+
       - name: Checkout
         uses: actions/checkout@v4
         with: