diff --git a/cmd/cli/cli.go b/cmd/cli/cli.go
index 4428d10..5cd9d1d 100644
--- a/cmd/cli/cli.go
+++ b/cmd/cli/cli.go
@@ -1646,7 +1646,7 @@ func cdUIDFromProvToken() string {
 	// Process provision token if provided.
 	resolverConfig, err := controld.FetchResolverUID(req, rootCmd.Version, cdDev)
 	if err != nil {
-		mainLog.Load().Fatal().Err(err).Msgf("failed to fetch resolver uid with provision token: %s", cdOrg)
+		mainLog.Load().Fatal().Err(err).Msgf("failed to fetch resolver uid with provision token: %s", redactToken(cdOrg))
 	}
 	return resolverConfig.UID
 }
@@ -2104,3 +2104,12 @@ func uninstallInvalidCdUID(p *prog, logger zerolog.Logger, doStop bool) bool {
 	}
 	return false
 }
+
+// redactToken returns the first 4 characters of a token followed by ***,
+// or just *** if the token is 4 characters or shorter.
+func redactToken(s string) string {
+	if len(s) <= 4 {
+		return "***"
+	}
+	return s[:4] + "***"
+}