diff --git a/manifests/plugins/dogtag.pp b/manifests/plugins/dogtag.pp
index 1e2d0126..8176ca41 100644
--- a/manifests/plugins/dogtag.pp
+++ b/manifests/plugins/dogtag.pp
@@ -80,7 +80,7 @@ class barbican::plugins::dogtag (
     'dogtag_plugin/dogtag_host':        value => $dogtag_plugin_dogtag_host;
     'dogtag_plugin/dogtag_port':        value => $dogtag_plugin_dogtag_port;
     'dogtag_plugin/nss_db_path':        value => $dogtag_plugin_nss_db_path;
-    'dogtag_plugin/nss_password':       value => $dogtag_plugin_nss_password;
+    'dogtag_plugin/nss_password':       value => $dogtag_plugin_nss_password, secret => true;
     'dogtag_plugin/simple_cmc_profile': value => $dogtag_plugin_simple_cmc_profile;
     'dogtag_plugin/ca_expiration_time': value => $dogtag_plugin_ca_expiration_time;
     'dogtag_plugin/plugin_working_dir': value => $dogtag_plugin_plugin_working_dir;
diff --git a/spec/classes/barbican_plugins_dogtag_spec.rb b/spec/classes/barbican_plugins_dogtag_spec.rb
index a12f9576..762aeb6d 100644
--- a/spec/classes/barbican_plugins_dogtag_spec.rb
+++ b/spec/classes/barbican_plugins_dogtag_spec.rb
@@ -85,7 +85,7 @@ describe 'barbican::plugins::dogtag' do
         is_expected.to contain_barbican_config('dogtag_plugin/nss_db_path')\
           .with_value(param_hash[:dogtag_plugin_nss_db_path])
         is_expected.to contain_barbican_config('dogtag_plugin/nss_password')\
-          .with_value(param_hash[:dogtag_plugin_nss_password])
+          .with_value(param_hash[:dogtag_plugin_nss_password]).with_secret(true)
         is_expected.to contain_barbican_config('dogtag_plugin/simple_cmc_profile')\
           .with_value(param_hash[:dogtag_plugin_simple_cmc_profile])
         is_expected.to contain_barbican_config('dogtag_plugin/ca_expiration_time')\