diff --git a/lib/config/decrypt.js b/lib/config/decrypt.js
index b1d35e5db5f0e6686c538361d8b835f1159f72cd..ce0ae529380f31c45fbb0824267927d761f37fe0 100644
--- a/lib/config/decrypt.js
+++ b/lib/config/decrypt.js
@@ -1,5 +1,6 @@
 const is = require('@sindresorhus/is');
 const crypto = require('crypto');
+const { maskToken } = require('../datasource/npm');
 
 module.exports = {
   decryptConfig,
@@ -19,7 +20,8 @@ function decryptConfig(config, privateKey) {
               .toString();
             logger.info(`Decrypted ${eKey}`);
             if (eKey === 'npmToken') {
-              logger.info('Migrating npmToken to npmrc');
+              const token = maskToken(decryptedStr);
+              logger.info({ token }, 'Migrating npmToken to npmrc');
               decryptedConfig.npmrc = `//registry.npmjs.org/:_authToken=${decryptedStr}\n`;
             } else {
               decryptedConfig[eKey] = decryptedStr;