diff --git a/castellan/key_manager/vault_key_manager.py b/castellan/key_manager/vault_key_manager.py
index 8d907c89..78d8b313 100644
--- a/castellan/key_manager/vault_key_manager.py
+++ b/castellan/key_manager/vault_key_manager.py
@@ -45,10 +45,13 @@ _DEFAULT_VERSION = 2
 
 _vault_opts = [
     cfg.StrOpt('root_token_id',
+               secret=True,
                help='root token for vault'),
     cfg.StrOpt('approle_role_id',
+               secret=True,
                help='AppRole role_id for authentication with vault'),
     cfg.StrOpt('approle_secret_id',
+               secret=True,
                help='AppRole secret_id for authentication with vault'),
     cfg.StrOpt('kv_mountpoint',
                default=_DEFAULT_MOUNTPOINT,