diff --git a/backend/src/main/resources/config/liquibase/changelog/20260522001_update_socai_custom_headers_password.xml b/backend/src/main/resources/config/liquibase/changelog/20260522001_update_socai_custom_headers_password.xml
new file mode 100644
index 000000000..fd402114f
--- /dev/null
+++ b/backend/src/main/resources/config/liquibase/changelog/20260522001_update_socai_custom_headers_password.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<databaseChangeLog
+    xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd">
+
+    <changeSet id="20260522001" author="Alex">
+        <comment>Set utmstack.socai.customHeaders data type to password</comment>
+        <sql dbms="postgresql" splitStatements="false">
+            <![CDATA[
+do $$
+declare
+    grp_id integer;
+begin
+    select id into grp_id from public.utm_module_group
+    where module_id = (select id from public.utm_module where module_name = 'SOC_AI')
+    limit 1;
+
+    IF grp_id IS NOT NULL THEN
+        UPDATE public.utm_module_group_configuration
+        SET conf_data_type = 'password'
+        WHERE group_id = grp_id AND conf_key = 'utmstack.socai.customHeaders';
+    END IF;
+end;
+$$ language plpgsql;
+            ]]>
+        </sql>
+    </changeSet>
+</databaseChangeLog>
diff --git a/backend/src/main/resources/config/liquibase/master.xml b/backend/src/main/resources/config/liquibase/master.xml
index eebe85f8c..a46172272 100644
--- a/backend/src/main/resources/config/liquibase/master.xml
+++ b/backend/src/main/resources/config/liquibase/master.xml
@@ -597,4 +597,6 @@
 
   <include file="/config/liquibase/changelog/20260409002_update_socai_config.xml" relativeToChangelogFile="false"/>
 
+  <include file="/config/liquibase/changelog/20260522001_update_socai_custom_headers_password.xml" relativeToChangelogFile="false"/>
+
 </databaseChangeLog>