diff --git a/.changeset/pretty-gorillas-cheat.md b/.changeset/pretty-gorillas-cheat.md
new file mode 100644
index 0000000000..d1500c6575
--- /dev/null
+++ b/.changeset/pretty-gorillas-cheat.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend': minor
+---
+
+**BREAKING**: `ctx.token` is now `ctx.secrets.backstageToken` in Actions. Please update any of your Actions that might call out to Backstage API's with this token.
diff --git a/plugins/scaffolder-backend/api-report.md b/plugins/scaffolder-backend/api-report.md
index d2967bf88a..a28db34c0c 100644
--- a/plugins/scaffolder-backend/api-report.md
+++ b/plugins/scaffolder-backend/api-report.md
@@ -41,7 +41,6 @@ export type ActionContext<Input extends JsonObject> = {
   baseUrl?: string;
   logger: Logger_2;
   logStream: Writable;
-  token?: string | undefined;
   secrets?: TaskSecrets;
   workspacePath: string;
   input: Input;
@@ -553,7 +552,6 @@ export class TaskManager implements TaskContext {
 
 // @public
 export type TaskSecrets = Record<string, string> & {
-  token?: string;
   backstageToken?: string;
 };
 
diff --git a/plugins/scaffolder-backend/src/scaffolder/actions/types.ts b/plugins/scaffolder-backend/src/scaffolder/actions/types.ts
index f1e5dd7b77..6008e8183f 100644
--- a/plugins/scaffolder-backend/src/scaffolder/actions/types.ts
+++ b/plugins/scaffolder-backend/src/scaffolder/actions/types.ts
@@ -28,12 +28,6 @@ export type ActionContext<Input extends JsonObject> = {
 
   logger: Logger;
   logStream: Writable;
-
-  /**
-   * User token forwarded from initial request, for use in subsequent api requests
-   * @deprecated use `secrets.backstageToken` instead
-   */
-  token?: string | undefined;
   secrets?: TaskSecrets;
   workspacePath: string;
   input: Input;
diff --git a/plugins/scaffolder-backend/src/scaffolder/tasks/HandlebarsWorkflowRunner.ts b/plugins/scaffolder-backend/src/scaffolder/tasks/HandlebarsWorkflowRunner.ts
index 91c82edebb..86e719c828 100644
--- a/plugins/scaffolder-backend/src/scaffolder/tasks/HandlebarsWorkflowRunner.ts
+++ b/plugins/scaffolder-backend/src/scaffolder/tasks/HandlebarsWorkflowRunner.ts
@@ -236,8 +236,6 @@ export class HandlebarsWorkflowRunner implements WorkflowRunner {
             logger: taskLogger,
             logStream: stream,
             input,
-            // this token is deprecated, and will be removed in favour of secrets.backstageToken instead.
-            token: task.secrets?.token,
             secrets: task.secrets ?? {},
             workspacePath,
             async createTemporaryDirectory() {
diff --git a/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.test.ts b/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.test.ts
index 1597c575ac..f46d969eb8 100644
--- a/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.test.ts
+++ b/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.test.ts
@@ -203,13 +203,15 @@ describe('DefaultWorkflowRunner', () => {
           ],
         },
         {
-          token: fakeToken,
+          backstageToken: fakeToken,
         },
       );
 
       await runner.execute(task);
 
-      expect(fakeActionHandler.mock.calls[0][0].token).toEqual(fakeToken);
+      expect(fakeActionHandler.mock.calls[0][0].secrets).toEqual(
+        expect.objectContaining({ backstageToken: fakeToken }),
+      );
     });
   });
 
diff --git a/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.ts b/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.ts
index 889e94d000..5d39d0bc00 100644
--- a/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.ts
+++ b/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.ts
@@ -258,17 +258,9 @@ export class NunjucksWorkflowRunner implements WorkflowRunner {
           const tmpDirs = new Array<string>();
           const stepOutput: { [outputName: string]: JsonValue } = {};
 
-          if (!task.spec.metadata) {
-            console.warn(
-              'DEPRECATION NOTICE: metadata is undefined. metadata will be required in the future.',
-            );
-          }
-
           await action.handler({
             baseUrl: task.spec.baseUrl,
             input,
-            // this token is deprecated, and will be removed in favour of secrets.backstageToken instead.
-            token: task.secrets?.token,
             secrets: task.secrets ?? {},
             logger: taskLogger,
             logStream: streamLogger,
diff --git a/plugins/scaffolder-backend/src/scaffolder/tasks/StorageTaskBroker.test.ts b/plugins/scaffolder-backend/src/scaffolder/tasks/StorageTaskBroker.test.ts
index 130f6ced13..93285a4ab3 100644
--- a/plugins/scaffolder-backend/src/scaffolder/tasks/StorageTaskBroker.test.ts
+++ b/plugins/scaffolder-backend/src/scaffolder/tasks/StorageTaskBroker.test.ts
@@ -38,7 +38,7 @@ async function createStore(): Promise<DatabaseTaskStore> {
 
 describe('StorageTaskBroker', () => {
   let storage: DatabaseTaskStore;
-  const fakeSecrets = { token: 'secret' } as TaskSecrets;
+  const fakeSecrets = { backstageToken: 'secret' } as TaskSecrets;
 
   beforeAll(async () => {
     storage = await createStore();
diff --git a/plugins/scaffolder-backend/src/scaffolder/tasks/types.ts b/plugins/scaffolder-backend/src/scaffolder/tasks/types.ts
index 8caee87f57..8b28fe562c 100644
--- a/plugins/scaffolder-backend/src/scaffolder/tasks/types.ts
+++ b/plugins/scaffolder-backend/src/scaffolder/tasks/types.ts
@@ -90,8 +90,6 @@ export type SerializedTaskEvent = {
  * @public
  */
 export type TaskSecrets = Record<string, string> & {
-  /** @deprecated Use `backstageToken` instead */
-  token?: string;
   backstageToken?: string;
 };
 
diff --git a/plugins/scaffolder-backend/src/service/router.test.ts b/plugins/scaffolder-backend/src/service/router.test.ts
index 6e01c3d880..b20dfa5d24 100644
--- a/plugins/scaffolder-backend/src/service/router.test.ts
+++ b/plugins/scaffolder-backend/src/service/router.test.ts
@@ -182,7 +182,7 @@ describe('createRouter', () => {
         spec: {} as any,
         status: 'completed',
         createdAt: '',
-        secrets: { token: 'secret' },
+        secrets: { backstageToken: 'secret' },
       });
 
       const response = await request(app).get(`/v2/tasks/a-random-id`);