diff --git a/frontend/src/lib/components/ApiConnectForm.svelte b/frontend/src/lib/components/ApiConnectForm.svelte
index a1a687b668..66ae52fa31 100644
--- a/frontend/src/lib/components/ApiConnectForm.svelte
+++ b/frontend/src/lib/components/ApiConnectForm.svelte
@@ -186,5 +186,13 @@
 		fixedOverflowWidgets={false}
 	/>
 {:else}
-	<SchemaForm noDelete {linkedSecretCandidates} bind:linkedSecret isValid {schema} bind:args />
+	<SchemaForm
+		onlyMaskPassword
+		noDelete
+		{linkedSecretCandidates}
+		bind:linkedSecret
+		isValid
+		{schema}
+		bind:args
+	/>
 {/if}
diff --git a/frontend/src/lib/components/AppConnect.svelte b/frontend/src/lib/components/AppConnect.svelte
index 0a6d13a8dd..c4940a88a3 100644
--- a/frontend/src/lib/components/AppConnect.svelte
+++ b/frontend/src/lib/components/AppConnect.svelte
@@ -138,9 +138,15 @@
 		}
 		return r
 	}
-	$: linkedSecret = linkedSecretCandidates?.sort(
-		(ua, ub) => linkedSecretValue(ub) - linkedSecretValue(ua)
-	)?.[0]
+
+	function forceSecretValue(resourceType: string): string | undefined {
+		if (resourceType == 'git_repository') {
+			return 'url'
+		}
+	}
+	$: linkedSecret =
+		forceSecretValue(resourceType) ??
+		linkedSecretCandidates?.sort((ua, ub) => linkedSecretValue(ub) - linkedSecretValue(ua))?.[0]
 
 	let scopes: string[] = []
 	let extra_params: [string, string][] = []
diff --git a/frontend/src/lib/components/ArgInput.svelte b/frontend/src/lib/components/ArgInput.svelte
index b5abdf99ba..e4ec4165d1 100644
--- a/frontend/src/lib/components/ArgInput.svelte
+++ b/frontend/src/lib/components/ArgInput.svelte
@@ -28,6 +28,7 @@
 	import FileUpload from './common/fileUpload/FileUpload.svelte'
 	import autosize from '$lib/autosize'
 	import PasswordArgInput from './PasswordArgInput.svelte'
+	import Password from './Password.svelte'
 
 	export let label: string = ''
 	export let value: any
@@ -70,6 +71,7 @@
 	export let showSchemaExplorer = false
 	export let simpleTooltip: string | undefined = undefined
 	export let customErrorMessage: string | undefined = undefined
+	export let onlyMaskPassword = false
 
 	let seeEditable: boolean = enum_ != undefined || pattern != undefined
 	const dispatch = createEventDispatcher()
@@ -651,7 +653,11 @@
 				<div class="flex flex-col w-full">
 					<div class="flex flex-row w-full items-center justify-between relative">
 						{#if password || extra?.['password'] == true}
-							<PasswordArgInput {disabled} bind:value />
+							{#if onlyMaskPassword}
+								<Password {disabled} bind:password={value} placeholder={defaultValue ?? ''} />
+							{:else}
+								<PasswordArgInput {disabled} bind:value />
+							{/if}
 						{:else}
 							{#key extra?.['minRows']}
 								<textarea
diff --git a/frontend/src/lib/components/ResourceEditor.svelte b/frontend/src/lib/components/ResourceEditor.svelte
index daeb030dba..63082d66c8 100644
--- a/frontend/src/lib/components/ResourceEditor.svelte
+++ b/frontend/src/lib/components/ResourceEditor.svelte
@@ -203,6 +203,7 @@
 						<Skeleton layout={[[4]]} />
 					{:else if !viewJsonSchema && resourceSchema && resourceSchema?.properties}
 						<SchemaForm
+							onlyMaskPassword
 							noDelete
 							disabled={!can_write}
 							compact
diff --git a/frontend/src/lib/components/SchemaForm.svelte b/frontend/src/lib/components/SchemaForm.svelte
index be61eedcb2..f6847f9e3b 100644
--- a/frontend/src/lib/components/SchemaForm.svelte
+++ b/frontend/src/lib/components/SchemaForm.svelte
@@ -33,6 +33,7 @@
 	export let disablePortal = false
 	export let showSchemaExplorer = false
 	export let showReset = false
+	export let onlyMaskPassword = false
 
 	let clazz: string = ''
 	export { clazz as class }
@@ -156,6 +157,7 @@
 								extra={schema.properties[argName]}
 								{showSchemaExplorer}
 								simpleTooltip={schemaFieldTooltip[argName]}
+								{onlyMaskPassword}
 							>
 								<svelte:fragment slot="actions">
 									{#if linkedSecretCandidates?.includes(argName)}
diff --git a/frontend/src/routes/approve/[workspace]/[job]/[resume]/[hmac]/+page.svelte b/frontend/src/routes/approve/[workspace]/[job]/[resume]/[hmac]/+page.svelte
index 52d518c6d4..cea6b7b580 100644
--- a/frontend/src/routes/approve/[workspace]/[job]/[resume]/[hmac]/+page.svelte
+++ b/frontend/src/routes/approve/[workspace]/[job]/[resume]/[hmac]/+page.svelte
@@ -218,6 +218,7 @@
 				<Alert type="warning" title="Adding a form to the approval page is an EE feature" />
 			{:else}
 				<SchemaForm
+					onlyMaskPassword
 					noVariablePicker
 					bind:isValid={valid}
 					schema={mergeSchema(schema, enum_payload)}