diff --git a/scripts/bao-session.sh b/scripts/bao-session.sh
index 402c2cc..2ac4e98 100755
--- a/scripts/bao-session.sh
+++ b/scripts/bao-session.sh
@@ -73,7 +73,9 @@ cmd_login() {
     echo "Opening OIDC login. Under WSL2 no browser will launch —"
     echo "copy the URL below into your Windows browser, then come back here."
     echo
-    bao login -method=oidc -path="$OIDC_PATH"
+    # -no-print: the token goes only to the token helper, never to the
+    # terminal (it once landed in an agent transcript, 2026-10-08).
+    bao login -no-print -method=oidc -path="$OIDC_PATH"
     echo
     cmd_status
 }