diff --git a/manifests/limit.pp b/manifests/limit.pp
index d8bdafb..1f320ee 100644
--- a/manifests/limit.pp
+++ b/manifests/limit.pp
@@ -66,7 +66,7 @@ define oslo::limit(
   $limit_options = {
     'oslo_limit/endpoint_id'         => { value => $endpoint_id },
     'oslo_limit/username'            => { value => $username },
-    'oslo_limit/password'            => { value => $password },
+    'oslo_limit/password'            => { value => $password, secret => true },
     'oslo_limit/auth_url'            => { value => $auth_url },
     'oslo_limit/project_name'        => { value => $project_name },
     'oslo_limit/user_domain_name'    => { value => $user_domain_name },
diff --git a/spec/defines/oslo_limit_spec.rb b/spec/defines/oslo_limit_spec.rb
index 163c507..718a4f9 100644
--- a/spec/defines/oslo_limit_spec.rb
+++ b/spec/defines/oslo_limit_spec.rb
@@ -24,7 +24,7 @@ describe 'oslo::limit' do
       it 'configures the required params' do
         is_expected.to contain_keystone_config('oslo_limit/endpoint_id').with_value('770f924a-e483-4b43-a6f3-73acc91f4757')
         is_expected.to contain_keystone_config('oslo_limit/username').with_value('keystone')
-        is_expected.to contain_keystone_config('oslo_limit/password').with_value('keystone_password')
+        is_expected.to contain_keystone_config('oslo_limit/password').with_value('keystone_password').with_secret(true)
         is_expected.to contain_keystone_config('oslo_limit/auth_url').with_value('http://127.0.0.1:5000/v3')
         is_expected.to contain_keystone_config('oslo_limit/project_name').with_value('services')
       end