diff --git a/manifests/orchestrator.pp b/manifests/orchestrator.pp
index 0d65907..1ec438f 100644
--- a/manifests/orchestrator.pp
+++ b/manifests/orchestrator.pp
@@ -32,7 +32,7 @@ class cloudkitty::orchestrator (
   }
 
   cloudkitty_config {
-    'orchestrator/coordination_url': value => $coordination_url;
+    'orchestrator/coordination_url': value => $coordination_url, secret => true;
     'orchestrator/max_workers':      value => $max_workers_real;
     'orchestrator/max_threads':      value => $max_threads;
   }
diff --git a/spec/classes/cloudkitty_orchestrator_spec.rb b/spec/classes/cloudkitty_orchestrator_spec.rb
index 6be1397..94337d1 100644
--- a/spec/classes/cloudkitty_orchestrator_spec.rb
+++ b/spec/classes/cloudkitty_orchestrator_spec.rb
@@ -9,7 +9,7 @@ describe 'cloudkitty::orchestrator' do
 
       it 'configures orchestrator' do
         is_expected.to contain_cloudkitty_config('orchestrator/coordination_url')\
-          .with_value('<SERVICE DEFAULT>')
+          .with_value('<SERVICE DEFAULT>').with_secret(true)
         is_expected.to contain_oslo__coordination('cloudkitty_config').with(
           :backend_url   => '<SERVICE DEFAULT>',
           :manage_config => false,
@@ -30,7 +30,7 @@ describe 'cloudkitty::orchestrator' do
 
       it 'configures orchestrator' do
         is_expected.to contain_cloudkitty_config('orchestrator/coordination_url')\
-          .with_value('etcd3+http://127.0.0.1:2379')
+          .with_value('etcd3+http://127.0.0.1:2379').with_secret(true)
         is_expected.to contain_oslo__coordination('cloudkitty_config').with(
           :backend_url   => 'etcd3+http://127.0.0.1:2379',
           :manage_config => false,