Terraform state file leaking OAuth client_secret for Genesys Cloud

We’re moving our Central support queue config to Terraform. I’m setting up an OAuth client for a custom adherence webhook, but the client_secret is ending up in plaintext in the .tfstate file. I tried using the sensitive argument on the resource, but it doesn’t seem to mask it in the state file itself. Here’s the config:

resource "genesyscloud_oauthclient" "adherence_webhook" {
 name = "Adherence Webhook Client"
 client_secret = var.oauth_secret
}

How do I keep that secret out of the state file?