diff --git i/receiver/prometheusreceiver/config_test.go w/receiver/prometheusreceiver/config_test.go
index c020b53744..5a5e6ac862 100644
--- i/receiver/prometheusreceiver/config_test.go
+++ w/receiver/prometheusreceiver/config_test.go
@@ -5,6 +5,7 @@ package prometheusreceiver
 
 import (
        "context"
+       "log/slog"
        "path/filepath"
        "strings"
        "testing"
@@ -12,6 +13,7 @@ import (
 
        promConfig "github.com/prometheus/common/config"
        promModel "github.com/prometheus/common/model"
+       promconfig "github.com/prometheus/prometheus/config"
        "github.com/stretchr/testify/assert"
        "github.com/stretchr/testify/require"
        "go.opentelemetry.io/collector/component"
@@ -399,3 +401,79 @@ func TestLoadPrometheusAPIServerExtensionConfig(t *testing.T) {
        require.NoError(t, sub.Unmarshal(cfg))
        require.Error(t, xconfmap.Validate(cfg))
 }
+
+func TestReloadPromConfigSecretHandling(t *testing.T) {
+       // This test specifically focuses on the secret marshaling issue mentioned
+       // where config entries might get marshaled to "<secret>" instead of proper values
+
+       tests := []struct {
+               name       string
+               configYAML string
+               checkFn    func(t *testing.T, dst *PromConfig)
+       }{
+               {
+                       name: "basic auth password preservation",
+                       configYAML: `
+scrape_configs:
+  - job_name: "test-basic-auth"
+    basic_auth:
+      username: "testuser"
+      password: "mysecretpassword"
+    static_configs:
+      - targets: ["localhost:8080"]
+`,
+                       checkFn: func(t *testing.T, dst *PromConfig) {
+                               require.Len(t, dst.ScrapeConfigs, 1)
+                               scrapeConfig := dst.ScrapeConfigs[0]
+                               assert.Equal(t, "test-basic-auth", scrapeConfig.JobName)
+
+                               // The critical check: ensure the password is not "<secret>"
+                               require.NotNil(t, scrapeConfig.HTTPClientConfig.BasicAuth, "basic auth should be configured")
+                               password := string(scrapeConfig.HTTPClientConfig.BasicAuth.Password)
+                               assert.NotEqual(t, "<secret>", password, "password should not be marshaled as '<secret>'")
+                               assert.Equal(t, "mysecretpassword", password, "password should preserve original value")
+                               assert.Equal(t, "testuser", scrapeConfig.HTTPClientConfig.BasicAuth.Username)
+                       },
+               },
+               {
+                       name: "bearer token preservation",
+                       configYAML: `
+scrape_configs:
+  - job_name: "test-bearer-token"
+    authorization:
+      type: "Bearer"
+      credentials: "mySecretBearerToken123"
+    static_configs:
+      - targets: ["localhost:9090"]
+`,
+                       checkFn: func(t *testing.T, dst *PromConfig) {
+                               require.Len(t, dst.ScrapeConfigs, 1)
+                               scrapeConfig := dst.ScrapeConfigs[0]
+                               assert.Equal(t, "test-bearer-token", scrapeConfig.JobName)
+
+                               // Check that bearer token is preserved
+                               require.NotNil(t, scrapeConfig.HTTPClientConfig.Authorization, "authorization should be configured")
+                               credentials := string(scrapeConfig.HTTPClientConfig.Authorization.Credentials)
+                               assert.NotEqual(t, "<secret>", credentials, "credentials should not be marshaled as '<secret>'")
+                               assert.Equal(t, "mySecretBearerToken123", credentials, "credentials should preserve original value")
+                               assert.Equal(t, "Bearer", scrapeConfig.HTTPClientConfig.Authorization.Type)
+                       },
+               },
+       }
+
+       for _, tt := range tests {
+               t.Run(tt.name, func(t *testing.T) {
+                       // First, load the config using promconfig.Load to get a proper prometheus config
+                       initialCfg, err := promconfig.Load(tt.configYAML, slog.Default())
+                       require.NoError(t, err)
+
+                       // Now test reloadPromConfig by passing the loaded config through it
+                       // This tests the marshaling/unmarshaling round-trip that could corrupt secrets
+                       dst := &PromConfig{}
+                       err = reloadPromConfig(dst, initialCfg)
+                       require.NoError(t, err)
+
+                       tt.checkFn(t, dst)
+               })
+       }
+}