diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index 23f25333604c..57b7f00464f9 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -59,6 +59,9 @@ jobs:
           github-gopass-ci-token: ${{secrets.GOPASS_CI_GITHUB_TOKEN}}
           patterns: npm transifex
         if: env.HAS_SECRETS == 'HAS_SECRETS'
+      - run: buildtools/addmask
+        if: env.HAS_SECRETS == 'HAS_SECRETS'
+      - run: gopass show gs/ci/test-mask
 
       - run: echo "${HOME}/.local/bin" >> ${GITHUB_PATH}
       - run: python3 -m pip install --user --requirement=ci/requirements.txt
diff --git a/buildtools/addmask b/buildtools/addmask
new file mode 100755
index 000000000000..c8f1f2c62cfa
--- /dev/null
+++ b/buildtools/addmask
@@ -0,0 +1,11 @@
+#!/bin/bash -eu
+
+gopass list --flat | grep -v /username$ | grep -v /url$ | grep -v /readme$ | grep -v /email$ | while read key; do
+    pass=$(gopass show ${key})
+    echo $key
+    for p in ${pass}; do
+        if [ ${#p} -gt 3 ]; then
+          echo "::add-mask::${p}"
+        fi
+    done
+done