diff --git a/lib/publish.sh b/lib/publish.sh
index 4246f8c..bee2c24 100644
--- a/lib/publish.sh
+++ b/lib/publish.sh
@@ -119,6 +119,8 @@ set_release_secrets() {
 
   gh secret set RELEASE_APP_ID --repo "$slug" --body "$RELEASE_APP_ID" >/dev/null ||
     die "could not set RELEASE_APP_ID on ${slug}"
-  gh secret set RELEASE_APP_PRIVATE_KEY --repo "$slug" --body "$RELEASE_APP_PRIVATE_KEY" >/dev/null ||
+  # On stdin: argv is visible to every user on the host.
+  printf '%s' "$RELEASE_APP_PRIVATE_KEY" |
+    gh secret set RELEASE_APP_PRIVATE_KEY --repo "$slug" >/dev/null ||
     die "could not set RELEASE_APP_PRIVATE_KEY on ${slug}"
 }
diff --git a/tests/publish.bats b/tests/publish.bats
index 0fc211c..99605b1 100644
--- a/tests/publish.bats
+++ b/tests/publish.bats
@@ -32,7 +32,9 @@ case "$1 $2" in
     [ "${GH_SCENARIO}" = absent ] && exit 1
     printf '{"name":"demo"}\n'; exit 0 ;;
   "repo create") exit 0 ;;
-  "secret set") exit 0 ;;
+  "secret set")
+    [[ "$*" == *--body* ]] || cat >>"${GH_LOG}.stdin"
+    exit 0 ;;
 esac
 
 # `gh api repos/<slug>/rulesets` with no -X is the listing; with -X POST it is
@@ -252,6 +254,19 @@ _project() {
   [ "$output" = 2 ]
 }
 
+@test "the release app private key reaches gh on stdin, never on argv" {
+  _stub_gh
+  _project
+
+  GH_SCENARIO=exists RELEASE_APP_ID=1 RELEASE_APP_PRIVATE_KEY=k3y-s3cret \
+    run scaffold publish "$PROJECT"
+  assert_ok
+  run grep -c 'k3y-s3cret' "$GH_LOG"
+  [ "$output" = 0 ]
+  run cat "${GH_LOG}.stdin"
+  [[ "$output" == *k3y-s3cret* ]]
+}
+
 @test "the ruleset it posts is valid json and carries the three rules" {
   # The payload is a heredoc, so a typo in it reaches GitHub as a 422 on
   # somebody's real repository rather than as a failure here.