@@ -108,7 +108,7 @@ it.effect("reads the newest version from the update feed file a mirror publishes
     // A feed for the wrong track is not trusted to mean the requested one.
     assert.include(
       yield* resolve("stable", "win32", "x64", "version: 1.5.0-nightly.20261101.2\n"),
-      "Could not read https://updates.example.com/t3code/latest.yml",
+      "Could not read latest.yml from Example Corp's update mirror.",
     );
     assert.include(yield* resolve("preview", "win32", "x64", ""), "has no preview builds");
   }),
 
@@ -108,16 +108,15 @@ export const resolveMirrorVersion = Effect.fn("cli.update.resolve_mirror")(funct
     });
   }
   const httpClient = yield* HttpClient.HttpClient;
-  const url = releaseAssetUrl(
-    mirror.feedUrl,
-    updateFeedFileName(
-      channel === "nightly" ? "nightly" : "latest",
-      yield* HostProcess.Platform,
-      yield* HostProcess.Architecture,
-    ),
+  const fileName = updateFeedFileName(
+    channel === "nightly" ? "nightly" : "latest",
+    yield* HostProcess.Platform,
+    yield* HostProcess.Architecture,
   );
+  const url = releaseAssetUrl(mirror.feedUrl, fileName);
+  // Not the URL, whose query can hold the mirror's access token.
   const unreadable = new CliUpdateError({
-    reason: `Could not read ${url} from ${mirror.organization}'s update mirror.`,
+    reason: `Could not read ${fileName} from ${mirror.organization}'s update mirror.`,
   });
   const body = yield* httpClient.get(url).pipe(
     Effect.flatMap(HttpClientResponse.filterStatusOk),