diff --git a/specification/containerinstance/resource-manager/Microsoft.ContainerInstance/stable/2021-10-01/containerInstance.json b/specification/containerinstance/resource-manager/Microsoft.ContainerInstance/stable/2021-10-01/containerInstance.json
index c38c0a7c94ea..af27b61b9b7f 100644
--- a/specification/containerinstance/resource-manager/Microsoft.ContainerInstance/stable/2021-10-01/containerInstance.json
+++ b/specification/containerinstance/resource-manager/Microsoft.ContainerInstance/stable/2021-10-01/containerInstance.json
@@ -1464,7 +1464,8 @@
         },
         "password": {
           "type": "string",
-          "description": "The password for the private registry."
+          "description": "The password for the private registry.",
+          "x-ms-secret": true
         },
         "identity": {
           "type": "string",
@@ -1874,7 +1875,8 @@
         },
         "password": {
           "type": "string",
-          "description": "The password to start the exec command."
+          "description": "The password to start the exec command.",
+          "x-ms-secret": true
         }
       }
     },
@@ -1888,7 +1890,8 @@
         },
         "password": {
           "type": "string",
-          "description": "The password to the output stream from the attach. Send as an Authorization header value when connecting to the websocketUri."
+          "description": "The password to the output stream from the attach. Send as an Authorization header value when connecting to the websocketUri.",
+          "x-ms-secret": true
         }
       }
     },