diff --git a/manifests/backend/s3.pp b/manifests/backend/s3.pp
index c0cdf4c..29e6361 100644
--- a/manifests/backend/s3.pp
+++ b/manifests/backend/s3.pp
@@ -80,8 +80,8 @@ class glare::backend::s3(
 
   # Glare hasn't its own store, glance_store should be used
   glare_config {
-    'glance_store/s3_store_access_key':              value => $access_key;
-    'glance_store/s3_store_secret_key':              value => $secret_key;
+    'glance_store/s3_store_access_key':              value => $access_key, secret => true;
+    'glance_store/s3_store_secret_key':              value => $secret_key, secret => true;
     'glance_store/s3_store_host':                    value => $host;
     'glance_store/s3_store_bucket':                  value => $bucket;
     'glance_store/s3_store_bucket_url_format':       value => $bucket_url_format;
diff --git a/spec/classes/glare_backend_s3_spec.rb b/spec/classes/glare_backend_s3_spec.rb
index d8ec6f1..370a97d 100644
--- a/spec/classes/glare_backend_s3_spec.rb
+++ b/spec/classes/glare_backend_s3_spec.rb
@@ -15,8 +15,8 @@ describe 'glare::backend::s3' do
 
       it 'configures glare.conf' do
         is_expected.to contain_glare_config('glance_store/default_store').with_value('s3')
-        is_expected.to contain_glare_config('glance_store/s3_store_access_key').with_value('access')
-        is_expected.to contain_glare_config('glance_store/s3_store_secret_key').with_value('secret')
+        is_expected.to contain_glare_config('glance_store/s3_store_access_key').with_value('access').with_secret(true)
+        is_expected.to contain_glare_config('glance_store/s3_store_secret_key').with_value('secret').with_secret(true)
         is_expected.to contain_glare_config('glance_store/s3_store_host').with_value('host')
         is_expected.to contain_glare_config('glance_store/s3_store_bucket').with_value('bucket')
         is_expected.to contain_glare_config('glance_store/s3_store_bucket_url_format').with_value('<SERVICE DEFAULT>')
@@ -45,8 +45,8 @@ describe 'glare::backend::s3' do
       end
 
       it 'configures glare.conf' do
-        is_expected.to contain_glare_config('glance_store/s3_store_access_key').with_value('access2')
-        is_expected.to contain_glare_config('glance_store/s3_store_secret_key').with_value('secret2')
+        is_expected.to contain_glare_config('glance_store/s3_store_access_key').with_value('access2').with_secret(true)
+        is_expected.to contain_glare_config('glance_store/s3_store_secret_key').with_value('secret2').with_secret(true)
         is_expected.to contain_glare_config('glance_store/s3_store_host').with_value('host2')
         is_expected.to contain_glare_config('glance_store/s3_store_bucket').with_value('bucket2')
         is_expected.to contain_glare_config('glance_store/s3_store_bucket_url_format').with_value('path')