diff --git a/pkg/config/auth.go b/pkg/config/auth.go
index 10611c23b5..3e7e743c8f 100644
--- a/pkg/config/auth.go
+++ b/pkg/config/auth.go
@@ -217,6 +217,60 @@ type (
 	}
 )
 
+func (a *auth) StripUpdateBodySecrets(body v1API.UpdateAuthConfigBody) v1API.UpdateAuthConfigBody {
+	body.SmtpPass = nil
+	// Only strip secrets for locally enabled providers because other envs won't be loaded
+	body.SmsTwilioAuthToken = nil
+	body.SmsTwilioVerifyAuthToken = nil
+	body.SmsMessagebirdAccessKey = nil
+	body.SmsTextlocalApiKey = nil
+	body.SmsVonageApiSecret = nil
+	body.HookMfaVerificationAttemptSecrets = nil
+	body.HookPasswordVerificationAttemptSecrets = nil
+	body.HookCustomAccessTokenSecrets = nil
+	body.HookSendSmsSecrets = nil
+	body.HookSendEmailSecrets = nil
+	body.ExternalAppleSecret = nil
+	body.ExternalAppleClientId = nil
+	body.ExternalAzureSecret = nil
+	body.ExternalAzureClientId = nil
+	body.ExternalBitbucketSecret = nil
+	body.ExternalBitbucketClientId = nil
+	body.ExternalDiscordSecret = nil
+	body.ExternalDiscordClientId = nil
+	body.ExternalFacebookSecret = nil
+	body.ExternalFacebookClientId = nil
+	body.ExternalFigmaSecret = nil
+	body.ExternalFigmaClientId = nil
+	body.ExternalGithubSecret = nil
+	body.ExternalGithubClientId = nil
+	body.ExternalGitlabSecret = nil
+	body.ExternalGitlabClientId = nil
+	body.ExternalGoogleSecret = nil
+	body.ExternalGoogleClientId = nil
+	body.ExternalKakaoSecret = nil
+	body.ExternalKakaoClientId = nil
+	body.ExternalKeycloakSecret = nil
+	body.ExternalKeycloakClientId = nil
+	body.ExternalLinkedinOidcSecret = nil
+	body.ExternalLinkedinOidcClientId = nil
+	body.ExternalNotionSecret = nil
+	body.ExternalNotionClientId = nil
+	body.ExternalSlackOidcSecret = nil
+	body.ExternalSlackOidcClientId = nil
+	body.ExternalSpotifySecret = nil
+	body.ExternalSpotifyClientId = nil
+	body.ExternalTwitchSecret = nil
+	body.ExternalTwitchClientId = nil
+	body.ExternalTwitterSecret = nil
+	body.ExternalTwitterClientId = nil
+	body.ExternalWorkosSecret = nil
+	body.ExternalWorkosClientId = nil
+	body.ExternalZoomSecret = nil
+	body.ExternalZoomClientId = nil
+	return body
+}
+
 func (a *auth) ToUpdateAuthConfigBody() v1API.UpdateAuthConfigBody {
 	body := v1API.UpdateAuthConfigBody{
 		SiteUrl:                           &a.SiteUrl,
diff --git a/pkg/config/updater.go b/pkg/config/updater.go
index 445000d0b8..81a15af093 100644
--- a/pkg/config/updater.go
+++ b/pkg/config/updater.go
@@ -10,11 +10,12 @@ import (
 )
 
 type ConfigUpdater struct {
-	client v1API.ClientWithResponses
+	client      v1API.ClientWithResponses
+	skipSecrets bool
 }
 
 func NewConfigUpdater(client v1API.ClientWithResponses) ConfigUpdater {
-	return ConfigUpdater{client: client}
+	return ConfigUpdater{client: client, skipSecrets: false}
 }
 
 func (u *ConfigUpdater) UpdateRemoteConfig(ctx context.Context, remote baseConfig, filter ...func(string) bool) error {
@@ -123,7 +124,11 @@ func (u *ConfigUpdater) UpdateAuthConfig(ctx context.Context, projectRef string,
 			return nil
 		}
 	}
-	if resp, err := u.client.V1UpdateAuthServiceConfigWithResponse(ctx, projectRef, c.ToUpdateAuthConfigBody()); err != nil {
+	var updateBody = c.ToUpdateAuthConfigBody()
+	if u.skipSecrets {
+		updateBody = c.StripUpdateBodySecrets(updateBody)
+	}
+	if resp, err := u.client.V1UpdateAuthServiceConfigWithResponse(ctx, projectRef, updateBody); err != nil {
 		return errors.Errorf("failed to update Auth config: %w", err)
 	} else if status := resp.StatusCode(); status < 200 || status >= 300 {
 		return errors.Errorf("unexpected status %d: %s", status, string(resp.Body))