diff --git a/manifests/agents/metadata.pp b/manifests/agents/metadata.pp
index a927af74e..da2000681 100644
--- a/manifests/agents/metadata.pp
+++ b/manifests/agents/metadata.pp
@@ -102,7 +102,7 @@ class neutron::agents::metadata (
     'DEFAULT/nova_metadata_port':             value => $metadata_port;
     'DEFAULT/nova_metadata_protocol':         value => $metadata_protocol;
     'DEFAULT/nova_metadata_insecure':         value => $metadata_insecure;
-    'DEFAULT/metadata_proxy_shared_secret':   value => $shared_secret;
+    'DEFAULT/metadata_proxy_shared_secret':   value => $shared_secret, secret => true;
     'DEFAULT/metadata_workers':               value => $metadata_workers;
     'DEFAULT/metadata_backlog':               value => $metadata_backlog;
     'DEFAULT/nova_client_cert':               value => $nova_client_cert;
diff --git a/spec/classes/neutron_agents_metadata_spec.rb b/spec/classes/neutron_agents_metadata_spec.rb
index 1508e6df9..f74480913 100644
--- a/spec/classes/neutron_agents_metadata_spec.rb
+++ b/spec/classes/neutron_agents_metadata_spec.rb
@@ -62,7 +62,7 @@ describe 'neutron::agents::metadata' do
       is_expected.to contain_neutron_metadata_agent_config('DEFAULT/metadata_workers').with(:value => facts[:os_workers])
       is_expected.to contain_neutron_metadata_agent_config('DEFAULT/metadata_backlog').with(:value => '<SERVICE DEFAULT>')
       is_expected.to contain_neutron_metadata_agent_config('DEFAULT/nova_metadata_insecure').with(:value => '<SERVICE DEFAULT>')
-      is_expected.to contain_neutron_metadata_agent_config('DEFAULT/metadata_proxy_shared_secret').with(:value => params[:shared_secret])
+      is_expected.to contain_neutron_metadata_agent_config('DEFAULT/metadata_proxy_shared_secret').with(:value => params[:shared_secret]).with_secret(true)
       is_expected.to contain_neutron_metadata_agent_config('DEFAULT/cache_url').with(:ensure => 'absent')
     end
   end