diff --git a/backend/windmill-api/src/variables.rs b/backend/windmill-api/src/variables.rs
index 9e8ef59454..cf0ab42671 100644
--- a/backend/windmill-api/src/variables.rs
+++ b/backend/windmill-api/src/variables.rs
@@ -337,6 +337,7 @@ async fn update_variable(
     if let Some(npath) = &ns.path {
         sqlb.set_str("path", npath);
     }
+    let ns_value_is_none = ns.value.is_none();
     if let Some(nvalue) = ns.value {
         let is_secret = if ns.is_secret.is_some() {
             ns.is_secret.unwrap()
@@ -365,6 +366,19 @@ async fn update_variable(
     }
 
     if let Some(nbool) = ns.is_secret {
+        let old_secret = sqlx::query_scalar!(
+            "SELECT is_secret from variable WHERE path = $1 AND workspace_id = $2",
+            &path,
+            &w_id
+        )
+        .fetch_optional(&mut tx)
+        .await?
+        .unwrap_or(false);
+        if old_secret != nbool && ns_value_is_none {
+            return Err(Error::BadRequest(
+                "cannot change is_secret without updating value too".to_string(),
+            ));
+        }
         sqlb.set_str("is_secret", nbool);
     }
     sqlb.returning("path");
diff --git a/frontend/src/lib/components/VariableEditor.svelte b/frontend/src/lib/components/VariableEditor.svelte
index c95ba7748b..ce75fa3b86 100644
--- a/frontend/src/lib/components/VariableEditor.svelte
+++ b/frontend/src/lib/components/VariableEditor.svelte
@@ -154,7 +154,11 @@
 					/>
 				</div>
 				<div class="mt-4">
-					<Toggle bind:checked={variable.is_secret} options={{ right: 'Secret' }} />
+					<Toggle
+						on:change={() => variable.is_secret && loadVariable(initialPath)}
+						bind:checked={variable.is_secret}
+						options={{ right: 'Secret' }}
+					/>
 					<div class="mb-2" />
 					{#if variable.is_secret}
 						<Alert type="warning" title="Audit log for each access">