diff --git a/manifests/init.pp b/manifests/init.pp
index 1c256441..5debce9f 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -228,8 +228,8 @@
   Boolean $manage_cli = true,
   String[1] $cli_version = 'installed',
   String[1] $cli_user = 'admin',
-  String[1] $cli_password = 'admin',
-  Optional[String[8]] $cli_token = undef,
+  Variant[String[1], Sensitive[String[1]]] $cli_password = 'admin',
+  Optional[Variant[String[8], Sensitive[String[8]]]] $cli_token = undef,
   Hash $cli_projects = {},
 ) {
   validate_rd_policy($admin_policies)