diff --git a/src/publish.ts b/src/publish.ts
index 997bfacf..39bb10d4 100644
--- a/src/publish.ts
+++ b/src/publish.ts
@@ -381,7 +381,10 @@ export async function getPAT(publisher: string, options: AuthenticationOptions):
 		return await getOIDCCredential(publisher);
 	}
 
-	if (options.pat) {
+	if (options.pat !== undefined) {
+		if (!options.pat) {
+			throw new Error('A Personal Access Token is required to publish an extension.');
+		}
 		return options.pat;
 	}
 
diff --git a/src/test/oidc.test.ts b/src/test/oidc.test.ts
index 2cbd8f8b..def6d132 100644
--- a/src/test/oidc.test.ts
+++ b/src/test/oidc.test.ts
@@ -131,6 +131,13 @@ describe('OIDC trusted publishing', () => {
 			/'--oidc' and '--azure-credential'/
 		);
 	});
+
+	it('clearly reports a missing Personal Access Token', async () => {
+		await assert.rejects(
+			getPAT('my-publisher', { pat: '' }),
+			/A Personal Access Token is required to publish an extension/
+		);
+	});
 });
 
 function createRequestHandler(