diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 3d6bf2be90..f2988626c5 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1788,6 +1788,12 @@ paths:
           in: query
           schema:
             type: boolean
+        - name: include_encrypted
+          description: |
+            ask to include the encrypted value if secret and decrypt secret is not true (default: false)
+          in: query
+          schema:
+            type: boolean
       responses:
         "200":
           description: variable
@@ -2225,7 +2231,8 @@ paths:
 
   /w/{workspace}/resources/get_value_interpolated/{path}:
     get:
-      summary: get resource interpolated (variables and resources are fully unrolled)
+      summary:
+        get resource interpolated (variables and resources are fully unrolled)
       operationId: getResourceValueInterpolated
       tags:
         - resource
@@ -2913,7 +2920,8 @@ paths:
           schema:
             type: string
         - name: first_parent_hash
-          description: mask to filter scripts whom first direct parent has exact hash
+          description:
+            mask to filter scripts whom first direct parent has exact hash
           in: query
           schema:
             type: string
@@ -3108,7 +3116,8 @@ paths:
 
   /workers/custom_tags:
     get:
-      summary: get all instance custom tags (tags are used to dispatch jobs to
+      summary:
+        get all instance custom tags (tags are used to dispatch jobs to
         different worker groups)
       operationId: getCustomTags
       tags:
@@ -3159,7 +3168,8 @@ paths:
 
   /w/{workspace}/scripts/delete/h/{hash}:
     post:
-      summary: delete script by hash (erase content but keep hash, require admin)
+      summary:
+        delete script by hash (erase content but keep hash, require admin)
       operationId: deleteScriptByHash
       tags:
         - script
@@ -3398,14 +3408,16 @@ paths:
             type: string
             format: date-time
         - name: scheduled_in_secs
-          description: schedule the script to execute in the number of seconds starting now
+          description:
+            schedule the script to execute in the number of seconds starting now
           in: query
           schema:
             type: integer
         - $ref: "#/components/parameters/ParentJob"
         - $ref: "#/components/parameters/NewJobId"
         - name: invisible_to_owner
-          description: make the run invisible to the the script owner (default false)
+          description:
+            make the run invisible to the the script owner (default false)
           in: query
           schema:
             type: boolean
@@ -4436,7 +4448,8 @@ paths:
             type: string
             format: date-time
         - name: scheduled_in_secs
-          description: schedule the script to execute in the number of seconds starting now
+          description:
+            schedule the script to execute in the number of seconds starting now
           in: query
           schema:
             type: integer
@@ -4444,7 +4457,8 @@ paths:
         - $ref: "#/components/parameters/NewJobId"
         - $ref: "#/components/parameters/IncludeHeader"
         - name: invisible_to_owner
-          description: make the run invisible to the the flow owner (default false)
+          description:
+            make the run invisible to the the flow owner (default false)
           in: query
           schema:
             type: boolean
@@ -4496,7 +4510,8 @@ paths:
             type: string
             format: date-time
         - name: scheduled_in_secs
-          description: schedule the script to execute in the number of seconds starting now
+          description:
+            schedule the script to execute in the number of seconds starting now
           in: query
           schema:
             type: integer
@@ -4504,7 +4519,8 @@ paths:
         - $ref: "#/components/parameters/NewJobId"
         - $ref: "#/components/parameters/IncludeHeader"
         - name: invisible_to_owner
-          description: make the run invisible to the the flow owner (default false)
+          description:
+            make the run invisible to the the flow owner (default false)
           in: query
           schema:
             type: boolean
@@ -4542,7 +4558,8 @@ paths:
             type: string
             format: date-time
         - name: scheduled_in_secs
-          description: schedule the script to execute in the number of seconds starting now
+          description:
+            schedule the script to execute in the number of seconds starting now
           in: query
           schema:
             type: integer
@@ -4550,7 +4567,8 @@ paths:
         - $ref: "#/components/parameters/NewJobId"
         - $ref: "#/components/parameters/IncludeHeader"
         - name: invisible_to_owner
-          description: make the run invisible to the the script owner (default false)
+          description:
+            make the run invisible to the the script owner (default false)
           in: query
           schema:
             type: boolean
@@ -4581,7 +4599,8 @@ paths:
         - $ref: "#/components/parameters/WorkspaceId"
         - $ref: "#/components/parameters/IncludeHeader"
         - name: invisible_to_owner
-          description: make the run invisible to the the script owner (default false)
+          description:
+            make the run invisible to the the script owner (default false)
           in: query
           schema:
             type: boolean
@@ -4614,7 +4633,8 @@ paths:
         - $ref: "#/components/parameters/WorkspaceId"
         - $ref: "#/components/parameters/IncludeHeader"
         - name: invisible_to_owner
-          description: make the run invisible to the the script owner (default false)
+          description:
+            make the run invisible to the the script owner (default false)
           in: query
           schema:
             type: boolean
@@ -4829,7 +4849,8 @@ paths:
         - job
       responses:
         "200":
-          description: the timestamp of the db that can be used to compute the drift
+          description:
+            the timestamp of the db that can be used to compute the drift
           content:
             application/json:
               schema:
@@ -5065,7 +5086,8 @@ paths:
 
   /w/{workspace}/jobs/resume_urls/{id}/{resume_id}:
     get:
-      summary: get resume urls given a job_id, resume_id and a nonce to resume a flow
+      summary:
+        get resume urls given a job_id, resume_id and a nonce to resume a flow
       operationId: getResumeUrls
       tags:
         - job
@@ -5616,7 +5638,8 @@ paths:
         - $ref: "#/components/parameters/WorkspaceId"
         - name: only_member_of
           in: query
-          description: only list the groups the user is member of (default false)
+          description:
+            only list the groups the user is member of (default false)
           schema:
             type: boolean
       responses:
@@ -5804,7 +5827,8 @@ paths:
         - $ref: "#/components/parameters/WorkspaceId"
         - name: only_member_of
           in: query
-          description: only list the folders the user is member of (default false)
+          description:
+            only list the folders the user is member of (default false)
           schema:
             type: boolean
       responses:
@@ -6491,7 +6515,9 @@ paths:
       parameters:
         - $ref: "#/components/parameters/WorkspaceId"
       requestBody:
-        description: S3 resource path to use to generate the connection settings. If empty, the S3 resource defined in the workspace settings will be used
+        description:
+          S3 resource path to use to generate the connection settings. If empty,
+          the S3 resource defined in the workspace settings will be used
         required: true
         content:
           application/json:
@@ -6569,7 +6595,9 @@ paths:
       parameters:
         - $ref: "#/components/parameters/WorkspaceId"
       requestBody:
-        description: S3 resource path to use to generate the connection settings. If empty, the S3 resource defined in the workspace settings will be used
+        description:
+          S3 resource path to use to generate the connection settings. If empty,
+          the S3 resource defined in the workspace settings will be used
         required: true
         content:
           application/json:
@@ -6840,7 +6868,8 @@ components:
         type: integer
     PerPage:
       name: per_page
-      description: number of items to return for a given page (default 30, max 100)
+      description:
+        number of items to return for a given page (default 30, max 100)
       in: query
       schema:
         type: integer
@@ -6974,7 +7003,8 @@ components:
         type: boolean
     ArgsFilter:
       name: args
-      description: filter on jobs containing those args as a json subset (@> in postgres)
+      description:
+        filter on jobs containing those args as a json subset (@> in postgres)
       in: query
       schema:
         type: string
@@ -6986,7 +7016,8 @@ components:
         type: string
     ResultFilter:
       name: result
-      description: filter on jobs containing those result as a json subset (@> in postgres)
+      description:
+        filter on jobs containing those result as a json subset (@> in postgres)
       in: query
       schema:
         type: string
diff --git a/backend/windmill-api/src/variables.rs b/backend/windmill-api/src/variables.rs
index c125934053..c810c0152b 100644
--- a/backend/windmill-api/src/variables.rs
+++ b/backend/windmill-api/src/variables.rs
@@ -102,6 +102,7 @@ async fn list_variables(
 #[derive(Deserialize)]
 struct GetVariableQuery {
     decrypt_secret: Option<bool>,
+    include_encrypted: Option<bool>,
 }
 
 async fn get_variable(
@@ -163,6 +164,8 @@ async fn get_variable(
                     mc.decrypt_base64_to_string(value)
                         .map_err(|e| Error::InternalErr(e.to_string()))?,
                 )
+            } else if q.include_encrypted.unwrap_or(false) {
+                Some(value)
             } else {
                 None
             },
diff --git a/cli/variable.ts b/cli/variable.ts
index 41c756bf71..09965c3a50 100644
--- a/cli/variable.ts
+++ b/cli/variable.ts
@@ -73,6 +73,7 @@ export async function pushVariable(
       log.debug(`Variable ${remotePath} is up-to-date`);
       return;
     }
+
     log.debug(`Variable ${remotePath} is not up-to-date, updating`);
 
     await VariableService.updateVariable({
@@ -122,13 +123,13 @@ async function push(
     remotePath,
     undefined,
     parseFromFile(filePath),
-    opts.plainSecrets
+    opts.plainSecrets ?? false
   );
   log.info(colors.bold.underline.green(`Variable ${remotePath} pushed`));
 }
 
 async function add(
-  opts: GlobalOptions & { public?: boolean },
+  opts: GlobalOptions & { public?: boolean; plainSecrets?: boolean },
   value: string,
   remotePath: string
 ) {
@@ -167,7 +168,7 @@ async function add(
       is_secret: !opts.public,
       description: "",
     },
-    true
+    opts.plainSecrets ?? false
   );
   log.info(colors.bold.underline.green(`Variable ${remotePath} pushed`));
 }