diff --git a/modules/gh-runner-gke/outputs.tf b/modules/gh-runner-gke/outputs.tf
index fe48a39..ee5063d 100644
--- a/modules/gh-runner-gke/outputs.tf
+++ b/modules/gh-runner-gke/outputs.tf
@@ -28,6 +28,7 @@ output "client_token" {
 
 output "ca_certificate" {
   description = "The cluster ca certificate (base64 encoded)"
+  sensitive   = true
   value       = module.runner-cluster.ca_certificate
 }