diff --git a/helper/plugin/grpc_provider.go b/helper/plugin/grpc_provider.go
index 510f47f3514b..37d27c6104ce 100644
--- a/helper/plugin/grpc_provider.go
+++ b/helper/plugin/grpc_provider.go
@@ -535,6 +535,11 @@ func (s *GRPCProviderServer) ReadResource(_ context.Context, req *proto.ReadReso
 		Msgpack: newStateMP,
 	}
 
+	// helper/schema did previously handle private data during refresh, but
+	// core is now going to expect this to be maintained in order to
+	// persist it in the state.
+	resp.Private = req.Private
+
 	return resp, nil
 }
 
diff --git a/plugin/grpc_provider.go b/plugin/grpc_provider.go
index ae9a4002dd75..5b190e2c187b 100644
--- a/plugin/grpc_provider.go
+++ b/plugin/grpc_provider.go
@@ -330,6 +330,7 @@ func (p *GRPCProvider) ReadResource(r providers.ReadResourceRequest) (resp provi
 	protoReq := &proto.ReadResource_Request{
 		TypeName:     r.TypeName,
 		CurrentState: &proto.DynamicValue{Msgpack: mp},
+		Private:      r.Private,
 	}
 
 	protoResp, err := p.client.ReadResource(p.ctx, protoReq)
@@ -348,6 +349,7 @@ func (p *GRPCProvider) ReadResource(r providers.ReadResourceRequest) (resp provi
 		}
 	}
 	resp.NewState = state
+	resp.Private = protoResp.Private
 
 	return resp
 }
diff --git a/providers/provider.go b/providers/provider.go
index 1aa08c271d16..7e0a74c58e96 100644
--- a/providers/provider.go
+++ b/providers/provider.go
@@ -176,6 +176,10 @@ type ReadResourceRequest struct {
 
 	// PriorState contains the previously saved state value for this resource.
 	PriorState cty.Value
+
+	// Private is an opaque blob that will be stored in state along with the
+	// resource. It is intended only for interpretation by the provider itself.
+	Private []byte
 }
 
 type ReadResourceResponse struct {
@@ -184,6 +188,10 @@ type ReadResourceResponse struct {
 
 	// Diagnostics contains any warnings or errors from the method call.
 	Diagnostics tfdiags.Diagnostics
+
+	// Private is an opaque blob that will be stored in state along with the
+	// resource. It is intended only for interpretation by the provider itself.
+	Private []byte
 }
 
 type PlanResourceChangeRequest struct {
diff --git a/terraform/eval_refresh.go b/terraform/eval_refresh.go
index 03bc948115d9..4dfb5b4e93d5 100644
--- a/terraform/eval_refresh.go
+++ b/terraform/eval_refresh.go
@@ -55,6 +55,7 @@ func (n *EvalRefresh) Eval(ctx EvalContext) (interface{}, error) {
 	req := providers.ReadResourceRequest{
 		TypeName:   n.Addr.Resource.Type,
 		PriorState: priorVal,
+		Private:    state.Private,
 	}
 
 	provider := *n.Provider
@@ -87,6 +88,7 @@ func (n *EvalRefresh) Eval(ctx EvalContext) (interface{}, error) {
 
 	newState := state.DeepCopy()
 	newState.Value = resp.NewState
+	newState.Private = resp.Private
 
 	// Call post-refresh hook
 	err = ctx.Hook(func(h Hook) (HookAction, error) {