diff --git a/docs/resources/workspace_proxy.md b/docs/resources/workspace_proxy.md
index 72262ff..fa87584 100644
--- a/docs/resources/workspace_proxy.md
+++ b/docs/resources/workspace_proxy.md
@@ -58,4 +58,4 @@ resource "kubernetes_deployment" "syd_wsproxy" {
 ### Read-Only
 
 - `id` (String) Workspace Proxy ID
-- `session_token` (String) Session token for the workspace proxy.
+- `session_token` (String, Sensitive) Session token for the workspace proxy.
diff --git a/internal/provider/workspace_proxy_resource.go b/internal/provider/workspace_proxy_resource.go
index 8cb16a7..146bc88 100644
--- a/internal/provider/workspace_proxy_resource.go
+++ b/internal/provider/workspace_proxy_resource.go
@@ -66,6 +66,7 @@ func (r *WorkspaceProxyResource) Schema(ctx context.Context, req resource.Schema
 			"session_token": schema.StringAttribute{
 				MarkdownDescription: "Session token for the workspace proxy.",
 				Computed:            true,
+				Sensitive:           true,
 				PlanModifiers: []planmodifier.String{
 					stringplanmodifier.UseStateForUnknown(),
 				},