diff --git a/.github/workflows/licensecheck.yml b/.github/workflows/licensecheck.yml
index 8d19f7cf..9a504590 100644
--- a/.github/workflows/licensecheck.yml
+++ b/.github/workflows/licensecheck.yml
@@ -12,7 +12,7 @@ on:
     # https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/
     inputs:
       dash-iplab-token:
-        description: "Gitlab Personal Access Token (https://gitlab.eclipse.org/-/profile/personal_access_tokens) with 'api'' scope for Automatic IP Team Review Requests via org.eclipse.dash:license-tool-plugin, see https://github.com/eclipse/dash-licenses#automatic-ip-team-review-requests"
+        description: "Gitlab Personal Access Token (https://gitlab.eclipse.org/-/user_settings/personal_access_tokens) with 'api'' scope for Automatic IP Team Review Requests via org.eclipse.dash:license-tool-plugin, see https://github.com/eclipse/dash-licenses#automatic-ip-team-review-requests"
         default: ""
         type: string
 
@@ -35,6 +35,15 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+    - name: Mask Dash IP Token
+      if: ${{ inputs.dash-iplab-token != '' }}
+      run: |
+        DASH_IPLAB_TOKEN=$(jq -r '.inputs.dash-iplab-token' $GITHUB_EVENT_PATH)
+        DASH_IPLAB_TOKEN=$(echo "$DASH_IPLAB_TOKEN" | xargs) # trim string
+        echo "::add-mask::$DASH_IPLAB_TOKEN"
+        echo "DASH_IPLAB_TOKEN=$DASH_IPLAB_TOKEN" >> $GITHUB_ENV
+
+
     - name: "Show: GitHub context"
       env:
         GITHUB_CONTEXT: ${{ toJSON(github) }}
@@ -86,8 +95,6 @@ jobs:
 
 
     - name: Dash License check  # see https://github.com/eclipse/dash-licenses
-      env:
-        DASH_IPLAB_TOKEN: "${{ inputs.dash-iplab-token }}"
       run: |
         set -eu
 
@@ -103,12 +110,12 @@ jobs:
         echo "MAVEN_OPTS: $MAVEN_OPTS"
 
         if [[ ${ACT:-} == "true" ]]; then # when running locally using nektos/act
-           maven_args="-Djgit.dirtyWorkingTree=warning"
+          maven_args="-Djgit.dirtyWorkingTree=warning"
         else
-           maven_args="--no-transfer-progress"
+          maven_args="--no-transfer-progress"
         fi
 
-        if [[ -n $DASH_IPLAB_TOKEN ]]; then
+        if [[ -n ${DASH_IPLAB_TOKEN:-} ]]; then
           dash_iplab_token_arg="-Ddash.iplab.token=$DASH_IPLAB_TOKEN"
         fi