From abd95c5154a82500c1f389a2614e979a777a0ef0 Mon Sep 17 00:00:00 2001
From: Paul Traina <pleasantone@users.noreply.github.com>
Date: Sat, 26 Sep 2026 10:43:06 -0700
Subject: [PATCH] [ld2410][mqtt][packages][security] Mark string-valued secrets
 cv.sensitive (#19387)

---
 esphome/components/ld2410/__init__.py   | 2 +-
 esphome/components/mqtt/__init__.py     | 4 ++--
 esphome/components/packages/__init__.py | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/esphome/components/ld2410/__init__.py b/esphome/components/ld2410/__init__.py
index f157cb50fd..d3179d9b30 100644
--- a/esphome/components/ld2410/__init__.py
+++ b/esphome/components/ld2410/__init__.py
@@ -87,7 +87,7 @@ CALIBRATION_ACTION_SCHEMA = maybe_simple_id(
 BLUETOOTH_PASSWORD_SET_SCHEMA = cv.Schema(
     {
         cv.Required(CONF_ID): cv.use_id(LD2410Component),
-        cv.Required(CONF_PASSWORD): cv.templatable(cv.string_strict),
+        cv.Required(CONF_PASSWORD): cv.sensitive(cv.templatable(cv.string_strict)),
     }
 )
 
diff --git a/esphome/components/mqtt/__init__.py b/esphome/components/mqtt/__init__.py
index 37694fcfc5..b6badb4ef9 100644
--- a/esphome/components/mqtt/__init__.py
+++ b/esphome/components/mqtt/__init__.py
@@ -243,8 +243,8 @@ CONFIG_SCHEMA = cv.All(
             cv.Inclusive(CONF_CLIENT_CERTIFICATE, "cert-key-pair"): cv.All(
                 cv.string, cv.only_on_esp32
             ),
-            cv.Inclusive(CONF_CLIENT_CERTIFICATE_KEY, "cert-key-pair"): cv.All(
-                cv.string, cv.only_on_esp32
+            cv.Inclusive(CONF_CLIENT_CERTIFICATE_KEY, "cert-key-pair"): cv.sensitive(
+                cv.All(cv.string, cv.only_on_esp32)
             ),
             cv.SplitDefault(CONF_SKIP_CERT_CN_CHECK, esp32=False): cv.All(
                 cv.boolean, cv.only_on_esp32
diff --git a/esphome/components/packages/__init__.py b/esphome/components/packages/__init__.py
index 171c6753ae..703af8281d 100644
--- a/esphome/components/packages/__init__.py
+++ b/esphome/components/packages/__init__.py
@@ -128,7 +128,7 @@ REMOTE_PACKAGE_SCHEMA = cv.All(
             cv.Required(CONF_URL): cv.url,
             cv.Optional(CONF_PATH): cv.string,
             cv.Optional(CONF_USERNAME): cv.string,
-            cv.Optional(CONF_PASSWORD): cv.string,
+            cv.Optional(CONF_PASSWORD): cv.sensitive(cv.string),
             cv.Exclusive(CONF_FILE, CONF_FILES): validate_yaml_filename,
             cv.Exclusive(CONF_FILES, CONF_FILES): cv.All(
                 cv.ensure_list(