diff --git a/docs/resources/workspace_proxy.md b/docs/resources/workspace_proxy.md
index 72262ff..fa87584 100644
--- a/docs/resources/workspace_proxy.md
+++ b/docs/resources/workspace_proxy.md
@@ -58,4 +58,4 @@ resource "kubernetes_deployment" "syd_wsproxy" {
 ### Read-Only
 
 - `id` (String) Workspace Proxy ID
-- `session_token` (String) Session token for the workspace proxy.
+- `session_token` (String, Sensitive) Session token for the workspace proxy.
diff --git a/internal/provider/workspace_proxy_resource.go b/internal/provider/workspace_proxy_resource.go
index 8cb16a7..146bc88 100644
--- a/internal/provider/workspace_proxy_resource.go
+++ b/internal/provider/workspace_proxy_resource.go
@@ -66,6 +66,7 @@ func (r *WorkspaceProxyResource) Schema(ctx context.Context, req resource.Schema
 			"session_token": schema.StringAttribute{
 				MarkdownDescription: "Session token for the workspace proxy.",
 				Computed:            true,
+				Sensitive:           true,
 				PlanModifiers: []planmodifier.String{
 					stringplanmodifier.UseStateForUnknown(),
 				},
diff --git a/internal/provider/workspace_proxy_resource_test.go b/internal/provider/workspace_proxy_resource_test.go
index 4829f85..2e5ed44 100644
--- a/internal/provider/workspace_proxy_resource_test.go
+++ b/internal/provider/workspace_proxy_resource_test.go
@@ -1,6 +1,7 @@
 package provider
 
 import (
+	"context"
 	"os"
 	"regexp"
 	"strings"
@@ -9,10 +10,22 @@ import (
 
 	"github.com/coder/coder/v2/coderd/util/ptr"
 	"github.com/coder/terraform-provider-coderd/integration"
+	fwresource "github.com/hashicorp/terraform-plugin-framework/resource"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/stretchr/testify/require"
 )
 
+func TestWorkspaceProxyResourceSessionTokenSensitive(t *testing.T) {
+	t.Parallel()
+
+	resp := &fwresource.SchemaResponse{}
+	(&WorkspaceProxyResource{}).Schema(context.Background(), fwresource.SchemaRequest{}, resp)
+	require.Empty(t, resp.Diagnostics)
+
+	attr := resp.Schema.Attributes["session_token"]
+	require.True(t, attr.IsSensitive())
+}
+
 func TestAccWorkspaceProxyResource(t *testing.T) {
 	t.Parallel()
 	if os.Getenv("TF_ACC") == "" {