diff --git a/.github/tf.sh b/.github/tf.sh
index 0ff4c54..801a386 100644
--- a/.github/tf.sh
+++ b/.github/tf.sh
@@ -2,9 +2,9 @@
 set -eo pipefail
 
 if [[ -e .envrc ]]; then
-  set -x
-  source .envrc
   set +x
+  # hide secret env values from output
+  source .envrc
 fi
 
 if [[ -z $IAC_BIN ]]; then