diff --git a/server/src/__tests__/logger-invitation-redaction.test.ts b/server/src/__tests__/logger-invitation-redaction.test.ts
new file mode 100644
index 00000000000..df025a8d6d0
--- /dev/null
+++ b/server/src/__tests__/logger-invitation-redaction.test.ts
@@ -0,0 +1,30 @@
+import { Writable } from "node:stream";
+import express from "express";
+import pino from "pino";
+import request from "supertest";
+import { describe, expect, it } from "vitest";
+import { createHttpLogger } from "../middleware/logger.js";
+import { HTTP_LOG_REDACT_PATHS } from "../middleware/http-log-redaction.js";
+
+describe("invitation bearer HTTP logs", () => {
+  it.each([202, 400, 500].flatMap(status => ["Referer", "Referrer"].map(header => ({ status, header }))))("keeps bearer paths private in $status request records with $header", async ({ status, header }) => {
+    const canary = "synthetic-invitation-bearer-canary";
+    const chunks: string[] = [];
+    const stream = new Writable({ write(chunk, _encoding, callback) { chunks.push(chunk.toString()); callback(); } });
+    const app = express();
+    app.use(createHttpLogger(pino({ redact: [...HTTP_LOG_REDACT_PATHS] }, stream)));
+    const router = express.Router();
+    router.post("/invites/:token/accept", (_req, res) => res.status(status).end());
+    app.use("/api", router);
+    const response = await request(app).post(`/api/invites/${canary}/accept`).set(header, `https://board.example/invite/${canary}?source=email`);
+    expect(response.status).toBe(status);
+    const output = chunks.join("");
+    expect(output).not.toContain(canary);
+    const record = JSON.parse(output.trim());
+    expect(record.req.method).toBe("POST");
+    expect(record.req.url).toBe("/api/invites/[REDACTED]/accept");
+    expect(record.req.headers[header.toLowerCase()]).toBe("https://board.example/invite/[REDACTED]");
+    expect(record.res.statusCode).toBe(status);
+    expect(record.msg).toContain(`POST /invites/[REDACTED]/accept ${status}`);
+  });
+});
diff --git a/server/src/__tests__/redact-sensitive.test.ts b/server/src/__tests__/redact-sensitive.test.ts
index 633d4adb9bd..6ba052041af 100644
--- a/server/src/__tests__/redact-sensitive.test.ts
+++ b/server/src/__tests__/redact-sensitive.test.ts
@@ -271,3 +271,19 @@ it("redacts Grok routine URL and key in setup failure logs", () => {
   expect(collectSensitiveStringValues(payload)).toContain(payload.webhookUrl);
   expect(collectSensitiveStringValues(payload)).toContain(payload.webhookKey);
 });
+
+describe("invitation bearer URL paths", () => {
+  it.each([
+    ["/api/invites/invite-bearer-canary/accept?token=query-canary", "/api/invites/[REDACTED]/accept"],
+    ["/invites/invite-bearer-canary/onboarding.txt", "/invites/[REDACTED]/onboarding.txt"],
+    ["/invite/invite-bearer-canary", "/invite/[REDACTED]"],
+    ["/API/INVITES/encoded%2Fbearer/skills/paperclip", "/API/INVITES/[REDACTED]/skills/paperclip"],
+    ["https://user:password@board.example/api/invites/invite-bearer-canary/accept#fragment", "https://board.example/api/invites/[REDACTED]/accept"],
+    ["/api/invites/invite-record-id/revoke", "/api/invites/invite-record-id/revoke"],
+    ["/invites/invite-record-id/revoke/", "/invites/invite-record-id/revoke/"],
+    ["/invite/invite-bearer-canary/revoke", "/invite/[REDACTED]/revoke"],
+    ["/api/companies/company/invites/invite-record-id", "/api/companies/company/invites/invite-record-id"],
+  ])("sanitizes %s without hiding the route", (input, expected) => {
+    expect(stripSecretBearingUrlParts(input)).toBe(expected);
+  });
+});
diff --git a/server/src/middleware/logger.ts b/server/src/middleware/logger.ts
index dbbc8f2202b..dcf545bb707 100644
--- a/server/src/middleware/logger.ts
+++ b/server/src/middleware/logger.ts
@@ -119,8 +119,14 @@ export function createHttpLogger(baseLogger: Logger) {
             url: privateWebhookLogUrl(req.url),
           };
         }
+        const headers = req.headers as Record<string, unknown> | undefined;
         return {
           ...req,
+          ...(headers ? { headers: {
+            ...headers,
+            ...Object.fromEntries(["referer", "referrer"].filter(key => typeof headers[key] === "string")
+              .map(key => [key, stripSecretBearingUrlParts(headers[key] as string)])),
+          } } : {}),
           url:
             typeof req.url === "string"
               ? stripSecretBearingUrlParts(req.url)
diff --git a/server/src/middleware/redact-sensitive.ts b/server/src/middleware/redact-sensitive.ts
index 9401287ba27..72f48c2ca1c 100644
--- a/server/src/middleware/redact-sensitive.ts
+++ b/server/src/middleware/redact-sensitive.ts
@@ -138,11 +138,14 @@ function isUrlishKey(key: string): boolean {
 export function stripSecretBearingUrlParts(value: string): string {
   const suffixStart = value.search(/[?#]/);
   const withoutQueryOrFragment =
-    suffixStart === -1 ? value : value.slice(0, suffixStart);
+    (suffixStart === -1 ? value : value.slice(0, suffixStart)).replace(
+      /(^|^[a-z][a-z\d+.-]*:\/\/[^/]*)(\/(?:(?:api\/)?invites\/(?![^/]+\/revoke(?:\/|$))|invite\/))[^/]+/i,
+      "$1$2[REDACTED]",
+    );
 
   try {
     const url = new URL(withoutQueryOrFragment);
-    if (!url.username && !url.password && suffixStart === -1) return value;
+    if (!url.username && !url.password) return withoutQueryOrFragment;
     url.username = "";
     url.password = "";
     return url.toString();