diff --git a/ci/steps/publish-npm.sh b/ci/steps/publish-npm.sh
index 58f625c84417..3c5b2542fdf9 100755
--- a/ci/steps/publish-npm.sh
+++ b/ci/steps/publish-npm.sh
@@ -46,7 +46,10 @@ main() {
 
   # This allows us to publish to npm in CI workflows
   if [[ ${CI-} ]]; then
-    echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
+    echo "Adding NPM_TOKEN to .npmrc"
+    # This is meant to be the literal value of ${NPM_TOKEN}, not the actual
+    # token itself.
+    echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' >> .npmrc
   fi
 
   ## Environment
@@ -142,6 +145,7 @@ main() {
 
   # Since the dev builds are scoped to @coder
   # We pass --access public to ensure npm knows it's not private.
+  echo "Publishing version $NPM_VERSION with tag $NPM_TAG"
   npm publish --non-interactive release --tag "$NPM_TAG" --access public
 }