Hiding OAuth secrets in Genesys Cloud Terraform state

The genesyscloud_oauth_client resource writes the secret directly to the .tfstate file, which breaks our security scan.

resource "genesyscloud_oauth_client" "app" {
 name = "monitoring-app"
 secret = var.oauth_secret
}

Is there a way to force Terraform to treat this as sensitive or remove it from the state without breaking the provider refresh cycle?