diff --git a/packages/targets/plugin-vscode/src/index.test.ts b/packages/targets/plugin-vscode/src/index.test.ts
index b44b26c0..bfa55107 100644
--- a/packages/targets/plugin-vscode/src/index.test.ts
+++ b/packages/targets/plugin-vscode/src/index.test.ts
@@ -109,4 +109,30 @@ describe('plugin-vscode target adapter', () => {
 
     expect(execMock).not.toHaveBeenCalled();
   });
+
+  it('passes the marketplace PAT through the child environment instead of argv', async () => {
+    execMock.mockResolvedValue({ exitCode: 0, stdout: '', stderr: '' });
+    const token = 'secret-marketplace-pat';
+    const ctx = fakeShipContext({
+      artifact: '/repo/.sh1pt/out/sample-extension-1.2.3.vsix',
+      version: '1.2.3',
+      dryRun: false,
+      secret: (key: string) => key === 'VSCE_TOKEN' ? token : undefined,
+    });
+
+    await adapter.ship(ctx as any, sampleConfig);
+
+    expect(execMock).toHaveBeenCalledWith('npx', [
+      '--yes',
+      'vsce',
+      'publish',
+      '--packagePath',
+      '/repo/.sh1pt/out/sample-extension-1.2.3.vsix',
+    ], {
+      env: { VSCE_PAT: token },
+      log: ctx.log,
+      throwOnNonZero: true,
+    });
+    expect(execMock.mock.calls[0]?.[1]).not.toContain(token);
+  });
 });
diff --git a/packages/targets/plugin-vscode/src/index.ts b/packages/targets/plugin-vscode/src/index.ts
index 7ec6f76e..bac92b8c 100644
--- a/packages/targets/plugin-vscode/src/index.ts
+++ b/packages/targets/plugin-vscode/src/index.ts
@@ -97,7 +97,8 @@ export default defineTarget<Config>({
       throw new Error('VSCE_TOKEN not set. Run: sh1pt secret set VSCE_TOKEN <pat>');
     }
 
-    await exec('npx', ['--yes', 'vsce', 'publish', '--pat', token, '--packagePath', ctx.artifact], {
+    await exec('npx', ['--yes', 'vsce', 'publish', '--packagePath', ctx.artifact], {
+      env: { VSCE_PAT: token },
       log: ctx.log,
       throwOnNonZero: true,
     });