diff --git a/addons/api/addon/serializers/credential-store.js b/addons/api/addon/serializers/credential-store.js
index dd65d40fe..e06137dfa 100644
--- a/addons/api/addon/serializers/credential-store.js
+++ b/addons/api/addon/serializers/credential-store.js
@@ -1,4 +1,5 @@
 import ApplicationSerializer from './application';
+import { copy } from 'ember-copy';
 
 export default class CredentialStoreSerializer extends ApplicationSerializer {
   /**
@@ -38,4 +39,12 @@ export default class CredentialStoreSerializer extends ApplicationSerializer {
     delete serialized.attributes;
     return serialized;
   }
+
+  normalize(typeClass, hash, ...rest) {
+    const normalizedHash = copy(hash, true);
+    const normalized = super.normalize(typeClass, normalizedHash, ...rest);
+    // Remove secret fields as we don't track them after being created/updated
+    normalized.data.attributes.token = '';
+    return normalized;
+  }
 }
diff --git a/addons/api/tests/unit/serializers/credential-store-test.js b/addons/api/tests/unit/serializers/credential-store-test.js
index 77a9b6faf..226217a5d 100644
--- a/addons/api/tests/unit/serializers/credential-store-test.js
+++ b/addons/api/tests/unit/serializers/credential-store-test.js
@@ -273,4 +273,35 @@ module('Unit | Serializer | credential store', function (hooks) {
     };
     assert.deepEqual(record.serialize(), expectedResult);
   });
+
+  test('it normalizes vault type credential store record', async function (assert) {
+    assert.expect(1);
+    const store = this.owner.lookup('service:store');
+    const serializer = store.serializerFor('credential-store');
+    const credentialStoreModelClass =
+      store.createRecord('credential-store').constructor;
+    const payload = {
+      id: 'csvlt_123',
+      version: 1,
+      type: 'vault',
+      attributes: {
+        token: 'random',
+        token_hmac: 'completenonsense',
+      },
+    };
+    const normalized = serializer.normalize(credentialStoreModelClass, payload);
+    assert.deepEqual(normalized, {
+      data: {
+        attributes: {
+          type: 'vault',
+          version: 1,
+          token: '',
+          token_hmac: 'completenonsense',
+        },
+        type: 'credential-store',
+        id: 'csvlt_123',
+        relationships: {},
+      },
+    });
+  });
 });
diff --git a/ui/admin/app/components/form/credential-store/vault/index.hbs b/ui/admin/app/components/form/credential-store/vault/index.hbs
index 4be4cc091..6dacafe78 100644
--- a/ui/admin/app/components/form/credential-store/vault/index.hbs
+++ b/ui/admin/app/components/form/credential-store/vault/index.hbs
@@ -6,6 +6,7 @@
   @showEditToggle={{if @model.isNew false true}}
   as |form|
 >
+
   <form.input
     @name='name'
     @type='name'
@@ -136,48 +137,51 @@
       </field.errors>
     {{/if}}
   </form.input>
-{{#if (feature-flag 'vault-worker-filter')}}
-  <form.input
-    @name='worker_filter'
-    @type='text'
-    @value={{@model.worker_filter}}
-    @label={{t 'form.worker_filter.label'}}
-    @error={{@model.errors.worker_filter}}
-    @helperText={{t 'form.worker_filter.help'}}
-    @linkText={{t 'actions.learn-more'}}
-    @link={{doc-url 'worker-filters'}}
-    disabled={{@model.isSaving}}
-    readonly={{false}}
-    as |field|
-  >
-    {{#if @model.errors.worker_filter}}
-      <field.errors as |errors|>
-        {{#each @model.errors.worker_filter as |error|}}
-          <errors.message>{{error.message}}</errors.message>
-        {{/each}}
-      </field.errors>
-    {{/if}}
-  </form.input>
-{{/if}}
-  <form.input
-    @name='token'
-    @type='text'
-    @value={{@model.token}}
-    @label={{t 'resources.credential-store.form.token.label'}}
-    @error={{@model.errors.token}}
-    @helperText={{t 'resources.credential-store.form.token.help'}}
-    disabled={{@model.isSaving}}
-    readonly={{false}}
-    as |field|
-  >
-    {{#if @model.errors.token}}
-      <field.errors as |errors|>
-        {{#each @model.errors.token as |error|}}
-          <errors.message>{{error.message}}</errors.message>
-        {{/each}}
-      </field.errors>
-    {{/if}}
-  </form.input>
+  {{#if (feature-flag 'vault-worker-filter')}}
+    <form.input
+      @name='worker_filter'
+      @type='text'
+      @value={{@model.worker_filter}}
+      @label={{t 'form.worker_filter.label'}}
+      @error={{@model.errors.worker_filter}}
+      @helperText={{t 'form.worker_filter.help'}}
+      @linkText={{t 'actions.learn-more'}}
+      @link={{doc-url 'worker-filters'}}
+      disabled={{@model.isSaving}}
+      readonly={{false}}
+      as |field|
+    >
+      {{#if @model.errors.worker_filter}}
+        <field.errors as |errors|>
+          {{#each @model.errors.worker_filter as |error|}}
+            <errors.message>{{error.message}}</errors.message>
+          {{/each}}
+        </field.errors>
+      {{/if}}
+    </form.input>
+  {{/if}}
+
+  {{#if (or @model.isNew form.isEditable)}}
+    <form.input
+      @name='token'
+      @type='text'
+      @value={{@model.token}}
+      @label={{t 'resources.credential-store.form.token.label'}}
+      @error={{@model.errors.token}}
+      @helperText={{t 'resources.credential-store.form.token.help'}}
+      disabled={{@model.isSaving}}
+      readonly={{false}}
+      as |field|
+    >
+      {{#if @model.errors.token}}
+        <field.errors as |errors|>
+          {{#each @model.errors.token as |error|}}
+            <errors.message>{{error.message}}</errors.message>
+          {{/each}}
+        </field.errors>
+      {{/if}}
+    </form.input>
+  {{/if}}
 
   {{#unless @model.isNew}}
     <form.input