diff --git a/.buildkite/scripts/crcr-report.sh b/.buildkite/scripts/crcr-report.sh
index e19146fddb..3b12d451cd 100644
--- a/.buildkite/scripts/crcr-report.sh
+++ b/.buildkite/scripts/crcr-report.sh
@@ -40,8 +40,7 @@ fi
 TOKEN_SECRET_KEY="${CRCR_BUILDKITE_TOKEN_SECRET_KEY:-CRCR_BUILDKITE_API_TOKEN}"
 BK_TOKEN="${BUILDKITE_API_TOKEN:-}"
 if [[ -z "${BK_TOKEN}" ]]; then
-    # Not in the job environment, so read it from a Buildkite secret. The agent
-    # redacts values fetched this way from the log.
+    # Not in the job environment, so read it from a Buildkite secret.
     #
     # Report why a lookup failed. Swallowing stderr made a missing secret, a
     # denied policy and an unusable agent indistinguishable, all surfacing as the
@@ -50,14 +49,9 @@ if [[ -z "${BK_TOKEN}" ]]; then
         echo "buildkite-agent is not on PATH; cannot read secret '${TOKEN_SECRET_KEY}'"
     else
         secret_err="$(mktemp)"
-        # Deliberately not passing --skip-redaction. On the deployed agent
-        # (v3.73.1) the flag cannot help: secret_get.go creates the Job API
-        # client unconditionally and only checks SkipRedaction afterwards, so
-        # under the docker plugin -- which does not expose the Job API socket to
-        # the container -- it fails before the flag is read. That ordering was
-        # only fixed in v3.107.0. Skipping redaction would also stop the token
-        # being registered with the log redactor, for no gain here.
-        if BK_TOKEN="$(buildkite-agent secret get "${TOKEN_SECRET_KEY}" 2>"${secret_err}")"; then
+        # Requires agent >= 3.107.0: the Docker plugin does not mount the Job API
+        # socket needed for redaction. Capture the value without logging it.
+        if BK_TOKEN="$(buildkite-agent secret get --skip-redaction "${TOKEN_SECRET_KEY}" 2>"${secret_err}")"; then
             if [[ -z "${BK_TOKEN}" ]]; then
                 echo "secret '${TOKEN_SECRET_KEY}' resolved but is empty"
             fi
@@ -77,7 +71,8 @@ if [[ -z "${BK_TOKEN}" ]]; then
 fi
 
 AUDIENCE="pytorch-cross-repo-ci-relay"
-OIDC_TOKEN="$(buildkite-agent oidc request-token --audience "${AUDIENCE}" 2>/dev/null)"
+# OIDC redaction also requires the unavailable Job API socket.
+OIDC_TOKEN="$(buildkite-agent oidc request-token --skip-redaction --audience "${AUDIENCE}" 2>/dev/null)"
 if [[ -z "${OIDC_TOKEN}" ]]; then
     echo "could not mint a Buildkite OIDC token -- skipping report"
     exit 0