diff --git a/manifests/agents/ovn_metadata.pp b/manifests/agents/ovn_metadata.pp
index 789f27afe..fac8fbdfa 100644
--- a/manifests/agents/ovn_metadata.pp
+++ b/manifests/agents/ovn_metadata.pp
@@ -162,7 +162,7 @@ class neutron::agents::ovn_metadata (
     'DEFAULT/nova_metadata_port':             value => $metadata_port;
     'DEFAULT/nova_metadata_protocol':         value => $metadata_protocol;
     'DEFAULT/nova_metadata_insecure':         value => $metadata_insecure;
-    'DEFAULT/metadata_proxy_shared_secret':   value => $shared_secret;
+    'DEFAULT/metadata_proxy_shared_secret':   value => $shared_secret, secret => true;
     'DEFAULT/metadata_workers':               value => $metadata_workers;
     'DEFAULT/metadata_backlog':               value => $metadata_backlog;
     'DEFAULT/nova_client_cert':               value => $nova_client_cert;
diff --git a/spec/classes/neutron_agents_ovn_metadata_spec.rb b/spec/classes/neutron_agents_ovn_metadata_spec.rb
index 4dc5f220e..19c5707a1 100644
--- a/spec/classes/neutron_agents_ovn_metadata_spec.rb
+++ b/spec/classes/neutron_agents_ovn_metadata_spec.rb
@@ -53,7 +53,7 @@ describe 'neutron::agents::ovn_metadata' do
       should contain_ovn_metadata_agent_config('DEFAULT/metadata_backlog').with(:value => '<SERVICE DEFAULT>')
       should contain_ovn_metadata_agent_config('DEFAULT/nova_metadata_insecure').with(:value => '<SERVICE DEFAULT>')
       should contain_ovn_metadata_agent_config('DEFAULT/state_path').with(:value => '/var/lib/neutron')
-      should contain_ovn_metadata_agent_config('DEFAULT/metadata_proxy_shared_secret').with(:value => params[:shared_secret])
+      should contain_ovn_metadata_agent_config('DEFAULT/metadata_proxy_shared_secret').with(:value => params[:shared_secret]).with_secret(true)
       should contain_ovn_metadata_agent_config('agent/root_helper').with(:value => 'sudo neutron-rootwrap /etc/neutron/rootwrap.conf')
       should contain_ovn_metadata_agent_config('agent/root_helper_daemon').with(:value => '<SERVICE DEFAULT>')
       should contain_ovn_metadata_agent_config('ovs/ovsdb_connection_timeout').with(:value => '<SERVICE DEFAULT>')