diff --git a/packages/targets/deploy-firebase/src/index.test.ts b/packages/targets/deploy-firebase/src/index.test.ts
index f4aa8799..a62151b0 100644
--- a/packages/targets/deploy-firebase/src/index.test.ts
+++ b/packages/targets/deploy-firebase/src/index.test.ts
@@ -2,13 +2,27 @@ import { fakeBuildContext, fakeShipContext, smokeTest } from '@profullstack/sh1p
 import { mkdtemp, readFile, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { afterEach, describe, expect, it } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+const { execMock } = vi.hoisted(() => ({
+  execMock: vi.fn(),
+}));
+
+vi.mock('@profullstack/sh1pt-core', async () => ({
+  ...(await vi.importActual<typeof import('@profullstack/sh1pt-core')>('@profullstack/sh1pt-core')),
+  exec: execMock,
+}));
+
 import adapter from './index.js';
 
 smokeTest(adapter, { idPrefix: 'deploy', requireKind: true });
 
 const tempDirs: string[] = [];
 
+beforeEach(() => {
+  execMock.mockReset();
+});
+
 afterEach(async () => {
   await Promise.all(tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true })));
 });
@@ -101,4 +115,21 @@ describe('Firebase deployment target', () => {
       projectId: 'my-firebase-project',
     })).rejects.toThrow('FIREBASE_TOKEN not in vault');
   });
+
+  it('passes the Firebase token through the child environment, not argv', async () => {
+    execMock.mockResolvedValue({ exitCode: 0, stdout: '{}', stderr: '' });
+
+    await adapter.ship(fakeShipContext({
+      dryRun: false,
+      secret: (key: string) => key === 'FIREBASE_TOKEN' ? 'firebase-secret-token' : undefined,
+    }) as any, {
+      projectId: 'my-firebase-project',
+    });
+
+    const [bin, args, options] = execMock.mock.calls[0] ?? [];
+    expect(bin).toBe('npx');
+    expect(args).not.toContain('firebase-secret-token');
+    expect(args).not.toContain('--token');
+    expect(options.env.FIREBASE_TOKEN).toBe('firebase-secret-token');
+  });
 });
diff --git a/packages/targets/deploy-firebase/src/index.ts b/packages/targets/deploy-firebase/src/index.ts
index 5793c047..63e019e0 100644
--- a/packages/targets/deploy-firebase/src/index.ts
+++ b/packages/targets/deploy-firebase/src/index.ts
@@ -51,14 +51,13 @@ function configPath(ctx: { projectDir: string }, config: Config): string | undef
   return isAbsolute(config.config) ? config.config : join(ctx.projectDir, config.config);
 }
 
-function deployArgs(ctx: { projectDir: string }, config: Config, token?: string): string[] {
+function deployArgs(ctx: { projectDir: string }, config: Config): string[] {
   config = normalizedConfig(config);
   const args = ['--yes', 'firebase-tools', 'deploy', '--project', config.projectId, '--json'];
   if (config.only?.length) args.push('--only', config.only.join(','));
   const firebaseConfig = configPath(ctx, config);
   if (firebaseConfig) args.push('--config', firebaseConfig);
   if (config.message) args.push('--message', config.message);
-  if (token) args.push('--token', token);
   return args;
 }
 
@@ -109,7 +108,7 @@ export default defineTarget<Config>({
       throw new Error('FIREBASE_TOKEN not in vault - run: sh1pt secret set FIREBASE_TOKEN <token>');
     }
 
-    const result = await exec('npx', deployArgs(ctx, config, token), {
+    const result = await exec('npx', deployArgs(ctx, config), {
       cwd: ctx.projectDir,
       env: { ...ctx.env, FIREBASE_TOKEN: token },
       log: ctx.log,