diff --git a/src/clis/nvcf-cli/internal/client/tasks.go b/src/clis/nvcf-cli/internal/client/tasks.go
index f4346809e..a9c31d2aa 100644
--- a/src/clis/nvcf-cli/internal/client/tasks.go
+++ b/src/clis/nvcf-cli/internal/client/tasks.go
@@ -360,16 +360,17 @@ func (c *Client) ListBasicTaskDetails(ctx context.Context, taskIDs []string) (*L
 	return decodeNVCT[ListBasicTaskDetailsResponse](resp)
 }
 
-// GetTask returns full details for a single task. When includeSecrets is true,
-// secret values are included in the response (subject to API authorization).
+// GetTask returns full details for a single task. includeSecrets controls
+// whether secret names are included in the response.
 func (c *Client) GetTask(ctx context.Context, taskID string, includeSecrets bool) (*TaskResponse, error) {
 	if taskID == "" {
 		return nil, fmt.Errorf("taskId is required")
 	}
-	endpoint := fmt.Sprintf("/v1/nvct/tasks/%s", url.PathEscape(taskID))
-	if includeSecrets {
-		endpoint += "?includeSecrets=true"
-	}
+	endpoint := fmt.Sprintf(
+		"/v1/nvct/tasks/%s?includeSecrets=%t",
+		url.PathEscape(taskID),
+		includeSecrets,
+	)
 
 	resp, err := c.makeNVCTRequest(ctx, "GET", endpoint, nil)
 	if err != nil {
diff --git a/src/clis/nvcf-cli/internal/client/tasks_test.go b/src/clis/nvcf-cli/internal/client/tasks_test.go
index 226cae6e7..904abc317 100644
--- a/src/clis/nvcf-cli/internal/client/tasks_test.go
+++ b/src/clis/nvcf-cli/internal/client/tasks_test.go
@@ -297,7 +297,7 @@ func TestGetTaskWithSecrets(t *testing.T) {
 		wantPath string
 		wantQS   string
 	}{
-		{"without flag", false, "/v1/nvct/tasks/task-id", ""},
+		{"without flag", false, "/v1/nvct/tasks/task-id", "includeSecrets=false"},
 		{"with flag", true, "/v1/nvct/tasks/task-id", "includeSecrets=true"},
 	}
 	for _, tt := range tests {