diff --git a/test/integration/cli_test.go b/test/integration/cli_test.go
index 1c239243..1221a604 100644
--- a/test/integration/cli_test.go
+++ b/test/integration/cli_test.go
@@ -107,12 +107,14 @@ func TestCLIGetKubeconfigStaticToken(t *testing.T) {
 
 func runPinnipedCLI(t *testing.T, envVars []string, pinnipedExe string, args ...string) (string, string) {
 	t.Helper()
+	start := time.Now()
 	var stdout, stderr bytes.Buffer
 	cmd := exec.Command(pinnipedExe, args...)
 	cmd.Stdout = &stdout
 	cmd.Stderr = &stderr
 	cmd.Env = envVars
 	require.NoErrorf(t, cmd.Run(), "stderr:\n%s\n\nstdout:\n%s\n\n", stderr.String(), stdout.String())
+	t.Logf("ran %q in %s", library.MaskTokens("pinniped "+strings.Join(args, " ")), time.Since(start).Round(time.Millisecond))
 	return stdout.String(), stderr.String()
 }
 
diff --git a/test/library/iotest.go b/test/library/iotest.go
index 6e2f1e58..7ac175b3 100644
--- a/test/library/iotest.go
+++ b/test/library/iotest.go
@@ -1,4 +1,4 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package library
@@ -43,6 +43,10 @@ func MaskTokens(in string) string {
 		if strings.Count(t, ".") >= 4 {
 			return t
 		}
+		// Another heuristic, things that start with "--" are probably CLI flags.
+		if strings.HasPrefix(t, "--") {
+			return t
+		}
 		return fmt.Sprintf("[...%d bytes...]", len(t))
 	})
 }