diff --git a/manifests/candlepin.pp b/manifests/candlepin.pp
index 4db6e9a..9e36436 100644
--- a/manifests/candlepin.pp
+++ b/manifests/candlepin.pp
@@ -29,7 +29,7 @@
   Optional[Stdlib::Port] $db_port = undef,
   String $db_name = 'candlepin',
   String $db_user = 'candlepin',
-  Optional[String] $db_password = undef,
+  Optional[Variant[Sensitive[String], String]] $db_password = undef,
   Boolean $db_ssl = false,
   Boolean $db_ssl_verify = true,
   Optional[Stdlib::Absolutepath] $db_ssl_ca = undef,
diff --git a/manifests/init.pp b/manifests/init.pp
index 822da21..9bd4188 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -45,7 +45,7 @@
   Optional[Stdlib::Port] $candlepin_db_port = undef,
   String $candlepin_db_name = 'candlepin',
   String $candlepin_db_user = 'candlepin',
-  Optional[String] $candlepin_db_password = undef,
+  Optional[Variant[Sensitive[String], String]] $candlepin_db_password = undef,
   Boolean $candlepin_db_ssl = false,
   Boolean $candlepin_db_ssl_verify = true,
   Optional[Stdlib::Absolutepath] $candlepin_db_ssl_ca = undef,