diff --git a/addons/api/addon/generated/models/host-catalog.js b/addons/api/addon/generated/models/host-catalog.js
index 8ef67e385..f786b4568 100644
--- a/addons/api/addon/generated/models/host-catalog.js
+++ b/addons/api/addon/generated/models/host-catalog.js
@@ -44,6 +44,11 @@ export default class GeneratedHostCatalogModel extends BaseModel {
   })
   attributes;
 
+  @attr({
+    description: 'Secrets specific to the plugin type',
+  })
+  secrets;
+
   @attr('number', {
     description: 'Current version number of this resource.',
   })
@@ -72,14 +77,14 @@ export default class GeneratedHostCatalogModel extends BaseModel {
   region;
 
   @attr('string', {
-    isNestedAttribute: true,
+    isNestedSecret: true,
     writeOnly: true,
     description: '',
   })
   access_key_id;
 
   @attr('string', {
-    isNestedAttribute: true,
+    isNestedSecret: true,
     writeOnly: true,
     description: '',
   })
@@ -106,14 +111,14 @@ export default class GeneratedHostCatalogModel extends BaseModel {
   subscription_id;
 
   @attr('string', {
-    isNestedAttribute: true,
+    isNestedSecret: true,
     writeOnly: true,
     description: '',
   })
   secret_id;
 
   @attr('string', {
-    isNestedAttribute: true,
+    isNestedSecret: true,
     writeOnly: true,
     description: '',
   })
diff --git a/addons/api/addon/serializers/host-catalog.js b/addons/api/addon/serializers/host-catalog.js
index 0bb99d19b..77c78c680 100644
--- a/addons/api/addon/serializers/host-catalog.js
+++ b/addons/api/addon/serializers/host-catalog.js
@@ -40,6 +40,12 @@ export default class HostCatalogSerializer extends ApplicationSerializer {
       if (!fieldsByType[compositeType].includes(key))
         delete json.attributes[key];
     }
+    // This deletes any fields that don't belong to the record type
+    if (isPlugin && options.isNestedSecret && json.secrets) {
+      if (!fieldsByType[compositeType].includes(key)) delete json.secrets[key];
+    }
+
+    // new one for isNestedSecret
     return value;
   }
 
@@ -47,6 +53,7 @@ export default class HostCatalogSerializer extends ApplicationSerializer {
     const serialized = super.serialize(...arguments);
     // Delete unnecessary fields for static host-catalog
     delete serialized.attributes;
+    delete serialized.secrets;
     return serialized;
   }
 }
diff --git a/addons/api/tests/unit/serializers/host-catalog-test.js b/addons/api/tests/unit/serializers/host-catalog-test.js
index df3f8efc8..018f1a1d8 100644
--- a/addons/api/tests/unit/serializers/host-catalog-test.js
+++ b/addons/api/tests/unit/serializers/host-catalog-test.js
@@ -61,6 +61,8 @@ module('Unit | Serializer | host catalog', function (hooks) {
       attributes: {
         disable_credential_rotation: true,
         region: 'spain',
+      },
+      secrets: {
         access_key_id: 'foobars',
         secret_access_key: 'testing',
       },
@@ -96,6 +98,8 @@ module('Unit | Serializer | host catalog', function (hooks) {
         tenant_id: 'a1b2c3',
         client_id: 'a1b2c3',
         subscription_id: 'a1b2c3',
+      },
+      secrets: {
         secret_id: 'a1b2c3',
         secret_value: 'a1b2c3',
       },
@@ -131,6 +135,8 @@ module('Unit | Serializer | host catalog', function (hooks) {
       attributes: {
         disable_credential_rotation: false,
         region: 'andorra',
+      },
+      secrets: {
         access_key_id: 'foobars',
         secret_access_key: 'testing',
       },
@@ -170,6 +176,8 @@ module('Unit | Serializer | host catalog', function (hooks) {
         tenant_id: 'a1b2c3',
         client_id: 'foobars12',
         subscription_id: 'barsfoo21',
+      },
+      secrets: {
         secret_id: 'secretBar12',
         secret_value: 'secretValue21',
       },