diff --git a/manifests/cli.pp b/manifests/cli.pp
index 5ff3566..4da4c0a 100644
--- a/manifests/cli.pp
+++ b/manifests/cli.pp
@@ -31,7 +31,7 @@
   Optional[Stdlib::HTTPUrl] $pulpcore_url = undef,
   String $version = 'installed',
   Optional[String] $username = undef,
-  Optional[String] $password = undef,
+  Optional[Variant[Sensitive[String], String]] $password = undef,
   Optional[String] $cert = undef,
   Optional[String] $key = undef,
   Optional[String] $api_root = undef,
diff --git a/templates/cli-config.toml.epp b/templates/cli-config.toml.epp
index d81b69e..a2e418f 100644
--- a/templates/cli-config.toml.epp
+++ b/templates/cli-config.toml.epp
@@ -1,12 +1,12 @@
 <%- |
-  Optional[Stdlib::HTTPUrl] $base_url = undef,
-  Optional[String]          $username = undef,
-  Optional[String]          $password = undef,
-  Optional[String]          $cert = undef,
-  Optional[String]          $key = undef,
-  Optional[String]          $api_root = undef,
-  Optional[Boolean]         $verify_ssl = undef,
-  Optional[Boolean]         $dry_run = undef,
+  Optional[Stdlib::HTTPUrl]                    $base_url = undef,
+  Optional[String]                             $username = undef,
+  Optional[Variant[Sensitive[String], String]] $password = undef,
+  Optional[String]                             $cert = undef,
+  Optional[String]                             $key = undef,
+  Optional[String]                             $api_root = undef,
+  Optional[Boolean]                            $verify_ssl = undef,
+  Optional[Boolean]                            $dry_run = undef,
 | -%>
 [cli]
 <% if $base_url { -%>