diff --git a/bin/heat-keystone-setup-domain b/bin/heat-keystone-setup-domain
index cbef823ee6..443865cb50 100755
--- a/bin/heat-keystone-setup-domain
+++ b/bin/heat-keystone-setup-domain
@@ -36,6 +36,7 @@ opts = [
                help="Keystone username with roles sufficient to manage users"
                     " and projects in the stack-user-domain"),
     cfg.StrOpt('stack-domain-admin-password',
+               secret=True,
                help="Password to set for stack-domain-admin"),
     cfg.BoolOpt('insecure',
                 default=False,
diff --git a/heat/common/config.py b/heat/common/config.py
index d700240c65..6902e8c745 100644
--- a/heat/common/config.py
+++ b/heat/common/config.py
@@ -71,6 +71,7 @@ service_opts = [
                help=_('Keystone username, a user with roles sufficient to '
                       'manage users and projects in the stack_user_domain.')),
     cfg.StrOpt('stack_domain_admin_password',
+               secret=True,
                help=_('Keystone password for stack_domain_admin user.')),
     cfg.IntOpt('max_template_size',
                default=524288,