diff --git a/esphome/yaml_util.py b/esphome/yaml_util.py
index 2b1514c746b..920892a5501 100644
--- a/esphome/yaml_util.py
+++ b/esphome/yaml_util.py
@@ -450,9 +450,9 @@ def _load_include_candidates(
         )
 
 
-# `!secret key`, quoted or not. A text scan, not a YAML parse, so it can also match
-# comments; that errs toward including more secrets.
-_SECRET_REFERENCE_RE = re.compile(r"""!secret\s+['"]?([^\s'"]+)""")
+# `!secret key`, quoted or not, also inside flow collections. A text scan, not a
+# YAML parse, so it can also match comments; that errs toward more secrets.
+_SECRET_REFERENCE_RE = re.compile(r"""!secret\s+['"]?([^\s'",\]}]+)""")
 
 
 def find_secret_references(text: str) -> set[str]:
diff --git a/tests/unit_tests/test_yaml_util.py b/tests/unit_tests/test_yaml_util.py
index 4355c1e4dc7..8fc492a123a 100644
--- a/tests/unit_tests/test_yaml_util.py
+++ b/tests/unit_tests/test_yaml_util.py
@@ -2239,3 +2239,9 @@ def test_load_yaml_fast_mode_records_dropped_merge_keys(
 
     yaml_util.load_yaml(yaml_file, track_document_range=False)
     assert yaml_util.take_dropped_merge_keys() == [("port", str(yaml_file))]
+
+
+def test_find_secret_references_in_flow_collections() -> None:
+    """Flow mapping and sequence punctuation is not part of the secret name."""
+    text = "a: {password: !secret wifi_pw}\nb: [!secret one, !secret 'two']\n"
+    assert yaml_util.find_secret_references(text) == {"wifi_pw", "one", "two"}