diff --git a/lib/flagutil/flag.go b/lib/flagutil/flag.go
index 706dc13f0..919cef462 100644
--- a/lib/flagutil/flag.go
+++ b/lib/flagutil/flag.go
@@ -4,12 +4,17 @@ import (
 	"flag"
 	"fmt"
 	"io"
+	"strings"
 )
 
 // WriteFlags writes all the explicitly set flags to w.
 func WriteFlags(w io.Writer) {
 	flag.Visit(func(f *flag.Flag) {
+		lname := strings.ToLower(f.Name)
 		value := f.Value.String()
+		if IsSecretFlag(lname) {
+			value = "secret"
+		}
 		fmt.Fprintf(w, "-%s=%q\n", f.Name, value)
 	})
 }