diff --git a/src/handlers/eval/batch-evaluation/simulate/index.tsx b/src/handlers/eval/batch-evaluation/simulate/index.tsx
index 4246021fe..2573b6a3a 100644
--- a/src/handlers/eval/batch-evaluation/simulate/index.tsx
+++ b/src/handlers/eval/batch-evaluation/simulate/index.tsx
@@ -21,11 +21,14 @@ export const createSimulateBatchEvaluationHandler = (core: Core, _io: AppIO) =>
         'JSON payload template; {input} is the scenario input, e.g. {"prompt":"{input}"}',
         z.string().optional(),
       ),
-      flag("header", "an ordered application header (repeatable)", z.array(z.string()).optional()),
+      flag("header", "an ordered application header (repeatable)", z.array(z.string()).optional(), {
+        sensitive: true,
+      }),
       flag(
         "bearer-token",
         "CUSTOM_JWT bearer token (for JWT-auth runtimes)",
         z.string().optional(),
+        { sensitive: true },
       ),
       flag("user-id", "runtime user id", z.string().optional()),
       flag("dataset", "dataset source: local JSONL path or a dataset id", z.string().optional()),
diff --git a/src/handlers/eval/ondemand/simulate/index.tsx b/src/handlers/eval/ondemand/simulate/index.tsx
index 37c0b41db..094b8a4be 100644
--- a/src/handlers/eval/ondemand/simulate/index.tsx
+++ b/src/handlers/eval/ondemand/simulate/index.tsx
@@ -22,11 +22,14 @@ export const createSimulateOnDemandHandler = (core: Core, _io: AppIO) =>
         'JSON payload template; {input} is the scenario input, e.g. {"prompt":"{input}"}',
         z.string().optional(),
       ),
-      flag("header", "an ordered application header (repeatable)", z.array(z.string()).optional()),
+      flag("header", "an ordered application header (repeatable)", z.array(z.string()).optional(), {
+        sensitive: true,
+      }),
       flag(
         "bearer-token",
         "CUSTOM_JWT bearer token (for JWT-auth runtimes)",
         z.string().optional(),
+        { sensitive: true },
       ),
       flag("user-id", "runtime user id", z.string().optional()),
       flag("dataset", "dataset source: local JSONL path or a dataset id", z.string().optional()),