diff --git a/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb b/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb
index 2065749a61608d09b92fba03ac79cf145c82c86a_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3JlY2lwZXMvZW5hYmxlLnJi..ed0dade2c088299a3b1a1658093f8d11921c7cb7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3JlY2lwZXMvZW5hYmxlLnJi 100644
--- a/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb
+++ b/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb
@@ -90,6 +90,7 @@
   mode '0640'
   notifies :restart, 'runit_service[gitlab-kas]'
   only_if { redis_password && !redis_password.empty? }
+  sensitive true
 end
 
 template gitlab_kas_config_file do
@@ -127,4 +128,5 @@
     config_file: gitlab_kas_config_file,
   }.merge(params))
   log_options node['gitlab']['logging'].to_hash.merge(node['gitlab-kas'].to_hash)
+  sensitive true
 end
diff --git a/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb b/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb
index 2065749a61608d09b92fba03ac79cf145c82c86a_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItcmFpbHMucmI=..ed0dade2c088299a3b1a1658093f8d11921c7cb7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItcmFpbHMucmI= 100644
--- a/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb
+++ b/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb
@@ -187,6 +187,7 @@
   mode "0640"
   variables node['gitlab']['gitlab-rails'].to_hash
   dependent_services.each { |svc| notifies :restart, svc }
+  sensitive true
 end
 
 redis_url = RedisHelper.new(node).redis_url
@@ -221,6 +222,7 @@
   mode "0644"
   variables(redis_url: redis_url, redis_sentinels: redis_sentinels, redis_enable_client: redis_enable_client)
   dependent_services.each { |svc| notifies :restart, svc }
+  sensitive true
 end
 
 templatesymlink "Create a cable.yml and create a symlink to Rails root" do
@@ -240,6 +242,7 @@
   mode "0644"
   variables(redis_url: url, redis_sentinels: sentinels, redis_enable_client: redis_enable_client)
   dependent_services.each { |svc| notifies :restart, svc }
+  sensitive true
 end
 
 %w(cache queues shared_state trace_chunks rate_limiting sessions).each do |instance|
@@ -259,6 +262,7 @@
     variables(redis_url: url, redis_sentinels: sentinels, redis_enable_client: redis_enable_client)
     dependent_services.each { |svc| notifies :restart, svc }
     not_if { url.nil? }
+    sensitive true
   end
 
   [from_filename, to_filename].each do |filename|
@@ -316,6 +320,7 @@
   )
   dependent_services.each { |svc| notifies :restart, svc }
   notifies :run, 'execute[clear the gitlab-rails cache]'
+  sensitive true
 end
 
 gitlab_workhorse_services = dependent_services
diff --git a/files/gitlab-cookbooks/gitlab/recipes/gitlab-shell.rb b/files/gitlab-cookbooks/gitlab/recipes/gitlab-shell.rb
index 2065749a61608d09b92fba03ac79cf145c82c86a_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItc2hlbGwucmI=..ed0dade2c088299a3b1a1658093f8d11921c7cb7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItc2hlbGwucmI= 100644
--- a/files/gitlab-cookbooks/gitlab/recipes/gitlab-shell.rb
+++ b/files/gitlab-cookbooks/gitlab/recipes/gitlab-shell.rb
@@ -73,6 +73,7 @@
               ssl_cert_dir: node['gitlab']['gitlab-shell']['ssl_cert_dir']
             })
   notifies :run, 'bash[Set proper security context on ssh files for selinux]', :delayed if SELinuxHelper.enabled?
+  sensitive true
 end
 
 link File.join(gitlab_shell_dir, ".gitlab_shell_secret") do
diff --git a/files/gitlab-cookbooks/gitlab/recipes/gitlab-workhorse.rb b/files/gitlab-cookbooks/gitlab/recipes/gitlab-workhorse.rb
index 2065749a61608d09b92fba03ac79cf145c82c86a_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItd29ya2hvcnNlLnJi..ed0dade2c088299a3b1a1658093f8d11921c7cb7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItd29ya2hvcnNlLnJi 100644
--- a/files/gitlab-cookbooks/gitlab/recipes/gitlab-workhorse.rb
+++ b/files/gitlab-cookbooks/gitlab/recipes/gitlab-workhorse.rb
@@ -119,4 +119,5 @@
   )
   notifies :restart, "runit_service[gitlab-workhorse]"
   notifies :run, 'bash[Set proper security context on ssh files for selinux]', :delayed if SELinuxHelper.enabled?
+  sensitive true
 end
diff --git a/files/gitlab-cookbooks/gitlab/resources/rails_migration.rb b/files/gitlab-cookbooks/gitlab/resources/rails_migration.rb
index 2065749a61608d09b92fba03ac79cf145c82c86a_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVzb3VyY2VzL3JhaWxzX21pZ3JhdGlvbi5yYg==..ed0dade2c088299a3b1a1658093f8d11921c7cb7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVzb3VyY2VzL3JhaWxzX21pZ3JhdGlvbi5yYg== 100644
--- a/files/gitlab-cookbooks/gitlab/resources/rails_migration.rb
+++ b/files/gitlab-cookbooks/gitlab/resources/rails_migration.rb
@@ -4,8 +4,8 @@
 property :name, name_property: true
 property :logfile_prefix, String, required: true
 property :rake_task, String, required: true
-property :helper, required: true
-property :environment
+property :helper, required: true, sensitive: true
+property :environment, sensitive: true
 property :dependent_services, Array, default: []
 
 default_action :run
@@ -31,5 +31,6 @@
     end
 
     not_if { new_resource.helper.migrated? }
+    sensitive true
   end
 end
diff --git a/files/gitlab-cookbooks/monitoring/recipes/gitlab-exporter.rb b/files/gitlab-cookbooks/monitoring/recipes/gitlab-exporter.rb
index 2065749a61608d09b92fba03ac79cf145c82c86a_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9tb25pdG9yaW5nL3JlY2lwZXMvZ2l0bGFiLWV4cG9ydGVyLnJi..ed0dade2c088299a3b1a1658093f8d11921c7cb7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9tb25pdG9yaW5nL3JlY2lwZXMvZ2l0bGFiLWV4cG9ydGVyLnJi 100644
--- a/files/gitlab-cookbooks/monitoring/recipes/gitlab-exporter.rb
+++ b/files/gitlab-cookbooks/monitoring/recipes/gitlab-exporter.rb
@@ -60,6 +60,7 @@
     connection_string: connection_string,
     redis_enable_client: node['gitlab']['gitlab-rails']['redis_enable_client']
   )
+  sensitive true
 end
 
 version_file 'Create version file for GitLab-Exporter' do
diff --git a/files/gitlab-cookbooks/monitoring/recipes/grafana.rb b/files/gitlab-cookbooks/monitoring/recipes/grafana.rb
index 2065749a61608d09b92fba03ac79cf145c82c86a_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9tb25pdG9yaW5nL3JlY2lwZXMvZ3JhZmFuYS5yYg==..ed0dade2c088299a3b1a1658093f8d11921c7cb7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9tb25pdG9yaW5nL3JlY2lwZXMvZ3JhZmFuYS5yYg== 100644
--- a/files/gitlab-cookbooks/monitoring/recipes/grafana.rb
+++ b/files/gitlab-cookbooks/monitoring/recipes/grafana.rb
@@ -141,6 +141,7 @@
   mode '0644'
   notifies :restart, 'runit_service[grafana]'
   only_if { node['monitoring']['grafana']['enable'] }
+  sensitive true
 end
 
 dashboards = {
diff --git a/files/gitlab-cookbooks/postgresql/recipes/bin.rb b/files/gitlab-cookbooks/postgresql/recipes/bin.rb
index 2065749a61608d09b92fba03ac79cf145c82c86a_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wb3N0Z3Jlc3FsL3JlY2lwZXMvYmluLnJi..ed0dade2c088299a3b1a1658093f8d11921c7cb7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wb3N0Z3Jlc3FsL3JlY2lwZXMvYmluLnJi 100644
--- a/files/gitlab-cookbooks/postgresql/recipes/bin.rb
+++ b/files/gitlab-cookbooks/postgresql/recipes/bin.rb
@@ -73,4 +73,5 @@
 template "/opt/gitlab/etc/gitlab-psql-rc" do
   owner 'root'
   group 'root'
+  sensitive true
 end
diff --git a/files/gitlab-cookbooks/redis/resources/service.rb b/files/gitlab-cookbooks/redis/resources/service.rb
index 2065749a61608d09b92fba03ac79cf145c82c86a_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9yZWRpcy9yZXNvdXJjZXMvc2VydmljZS5yYg==..ed0dade2c088299a3b1a1658093f8d11921c7cb7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9yZWRpcy9yZXNvdXJjZXMvc2VydmljZS5yYg== 100644
--- a/files/gitlab-cookbooks/redis/resources/service.rb
+++ b/files/gitlab-cookbooks/redis/resources/service.rb
@@ -44,6 +44,7 @@
     mode "0644"
     variables(node['redis'].to_hash.merge({ is_replica: is_replica }))
     notifies :restart, 'runit_service[redis]', :immediately if new_resource.omnibus_helper.should_notify?('redis')
+    sensitive true
   end
 
   runit_service 'redis' do