diff --git a/lib/oidc-utils.js b/lib/oidc-utils.js
index e230a3326..087190ea9 100644
--- a/lib/oidc-utils.js
+++ b/lib/oidc-utils.js
@@ -173,7 +173,6 @@ class OidcUtils {
     }
     static setOidcStepOutputs(username, accessToken) {
         core.setSecret(accessToken);
-        core.setSecret(username);
         core.setOutput('oidc-token', accessToken);
         core.setOutput('oidc-user', username);
     }
diff --git a/src/oidc-utils.ts b/src/oidc-utils.ts
index a7b324ce2..972359207 100644
--- a/src/oidc-utils.ts
+++ b/src/oidc-utils.ts
@@ -157,7 +157,6 @@ export class OidcUtils {
 
     public static setOidcStepOutputs(username: string, accessToken: string): void {
         core.setSecret(accessToken);
-        core.setSecret(username);
         core.setOutput('oidc-token', accessToken);
         core.setOutput('oidc-user', username);
     }
diff --git a/test/oidc-utils.spec.ts b/test/oidc-utils.spec.ts
index 63f9d648d..f82e8029f 100644
--- a/test/oidc-utils.spec.ts
+++ b/test/oidc-utils.spec.ts
@@ -121,10 +121,10 @@ describe('OidcUtils', (): void => {
     });
 
     describe('setOidcStepOutputs', (): void => {
-        it('should export user/token as step output and secret', (): void => {
+        it('should export user/token as step output and mark token as secret', (): void => {
             OidcUtils.setOidcStepOutputs('foo', 'bar');
             expect(core.setSecret).toHaveBeenCalledWith('bar');
-            expect(core.setSecret).toHaveBeenCalledWith('foo');
+            expect(core.setSecret).not.toHaveBeenCalledWith('foo');
             expect(core.setOutput).toHaveBeenCalledWith('oidc-token', 'bar');
             expect(core.setOutput).toHaveBeenCalledWith('oidc-user', 'foo');
         });