diff --git a/jeannie b/jeannie
index 238cdb3..bc06699 100755
--- a/jeannie
+++ b/jeannie
@@ -642,6 +642,19 @@ jeannie_verbose_enabled() {
     truthy "${JEANNIE_VERBOSE:-false}"
 }
 
+redact_sensitive_output() {
+    sed -E \
+        -e 's/(GITEA_BOOTSTRAP_PASSWORD=)["'\'']?[^"'\''[:space:]]+["'\'']?/\1[REDACTED]/g' \
+        -e 's/(PIHOLE_WEBPASSWORD=)["'\'']?[^"'\''[:space:]]+["'\'']?/\1[REDACTED]/g' \
+        -e 's/(COSIGN_PASSWORD=)["'\'']?[^"'\''[:space:]]+["'\'']?/\1[REDACTED]/g' \
+        -e 's/(GITEA_RUNNER_REGISTRATION_TOKEN=)["'\'']?[^"'\''[:space:]]+["'\'']?/\1[REDACTED]/g' \
+        -e 's/(--password[=[:space:]]+)["'\'']?[^"'\''[:space:]]+["'\'']?/\1[REDACTED]/g' \
+        -e 's/(--token[=[:space:]]+)["'\'']?[^"'\''[:space:]]+["'\'']?/\1[REDACTED]/g' \
+        -e 's/(password[=:][[:space:]]*)[^[:space:]]+/\1[REDACTED]/Ig' \
+        -e 's/(token[=:][[:space:]]*)[^[:space:]]+/\1[REDACTED]/Ig' \
+        -e 's#(https?://[^:/[:space:]]+):[^@/[:space:]]+@#\1:[REDACTED]@#g'
+}
+
 run_step() {
     local description="$1"
     local step_log
@@ -663,13 +676,13 @@ run_step() {
 
     if jeannie_verbose_enabled; then
         set +e
-        "$@" 2>&1 | tee "${step_log}"
+        "$@" 2>&1 | redact_sensitive_output | tee "${step_log}"
         status=${PIPESTATUS[0]}
         set -e
     else
         set +e
-        "$@" >"${step_log}" 2>&1
-        status=$?
+        "$@" 2>&1 | redact_sensitive_output >"${step_log}"
+        status=${PIPESTATUS[0]}
         set -e
     fi