diff --git a/internal/app/auth.go b/internal/app/auth.go
index 2bb08076..2dc8ad73 100644
--- a/internal/app/auth.go
+++ b/internal/app/auth.go
@@ -801,6 +801,16 @@ $ tea auth token --host gitea.com --user alice`,
 			if instance, err := settings.ResolveHost(a.tokenInstance(), s.Hosts.Hosts); err != nil || instance != t.Host {
 				token = ""
 			}
+			if token != "" && t.User != "" {
+				// Like connect, print the environment token only for the account it authenticates.
+				actual, err := services.CurrentAccount(cmd.Context(), a.deps.Client(t.Host, token, t.host.Insecure))
+				if err != nil {
+					return err
+				}
+				if !services.MatchAccount(t.User, actual) {
+					return clierr.Wrap(clierr.Authentication, errEnvironmentAccount)
+				}
+			}
 			if token == "" {
 				account, exists := t.host.Users[t.User]
 				switch {
diff --git a/internal/app/auth_test.go b/internal/app/auth_test.go
index 8ef198fe..75a62cc9 100644
--- a/internal/app/auth_test.go
+++ b/internal/app/auth_test.go
@@ -742,7 +742,9 @@ func TestAuthSwitchSelectsInstanceAndAccount(t *testing.T) {
 }
 
 func TestAuthTokenPrintsTheCredential(t *testing.T) {
-	const instance = "https://example.org"
+	server := newAuthenticatedServer(http.NotFoundHandler())
+	defer server.Close()
+	instance := server.URL
 	deps, out, _ := testDeps(t)
 	configureAccounts(t, deps, instance, "alice", "alice")
 	require.NoError(t, Execute(context.Background(), deps, []string{"auth", "token"}))
diff --git a/internal/app/target.go b/internal/app/target.go
index 95613409..0ecdd1c9 100644
--- a/internal/app/target.go
+++ b/internal/app/target.go
@@ -37,6 +37,9 @@ type target struct {
 
 var errRepositoryRequired = errors.New("repository required: use --repo owner/name")
 
+// errEnvironmentAccount must not reveal which account the GITEA_TOKEN belongs to.
+var errEnvironmentAccount = errors.New("GITEA_TOKEN does not belong to the selected account; supply its matching --user or remove the environment token to use stored credentials")
+
 func (a *application) resolve(ctx context.Context, requireRepo bool) (target, error) {
 	return a.resolveTarget(ctx, requireRepo, true)
 }
@@ -185,7 +188,7 @@ func (a *application) connect(ctx context.Context, req targetRequest) (target, e
 		}
 		// The message must not reveal which account the token belongs to.
 		if !services.MatchAccount(t.User, actual) {
-			return t, clierr.Wrap(clierr.Authentication, errors.New("GITEA_TOKEN does not belong to the selected account; supply its matching --user or remove the environment token to use stored credentials"))
+			return t, clierr.Wrap(clierr.Authentication, errEnvironmentAccount)
 		}
 		if t.User == "" {
 			t.UserSource = "GITEA_TOKEN authenticated account"