diff --git a/pkg/resource/plugin/analyzer_plugin.go b/pkg/resource/plugin/analyzer_plugin.go
index <HASH>..<HASH> 100644
--- a/pkg/resource/plugin/analyzer_plugin.go
+++ b/pkg/resource/plugin/analyzer_plugin.go
@@ -118,7 +118,7 @@ func (a *analyzer) Analyze(
 
 	label := fmt.Sprintf("%s.Analyze(%s)", a.label(), t)
 	logging.V(7).Infof("%s executing (#props=%d)", label, len(props))
-	mprops, err := MarshalProperties(props, MarshalOptions{KeepUnknowns: true})
+	mprops, err := MarshalProperties(props, MarshalOptions{KeepUnknowns: true, KeepSecrets: true})
 	if err != nil {
 		return nil, err
 	}
Don't throw away secrets in calls to Analyze