Terraform state file leaking Genesys Cloud OAuth secrets

Trying to set up our Genesys Cloud org via Terraform. Using genesyscloud_platform_oauthclient to create the integration.

The problem is the secret field ends up in the .tfstate file as plaintext. We’ve tried setting sensitive = true on the variable, but it’s still sitting there in the JSON state dump.

How do we keep that secret out of the state file entirely?