diff --git a/terranix/modules/push_approles.nix b/terranix/modules/push_approles.nix
index ee975d7..d06ab21 100644
--- a/terranix/modules/push_approles.nix
+++ b/terranix/modules/push_approles.nix
@@ -90,7 +90,7 @@ in
           provisioner = {
             "remote-exec" = {
               inline = [
-                "echo \${vault_approle_auth_backend_role_secret_id.system-${hostname}.secret_id} > /var/secrets/approle.secretid"
+                "echo \${nonsensitive(vault_approle_auth_backend_role_secret_id.system-${hostname}.secret_id)} > /var/secrets/approle.secretid"
                 "echo \${data.vault_approle_auth_backend_role_id.system-${hostname}.role_id} > /var/secrets/approle.roleid"
               ];
             };