diff --git a/Cargo.lock b/Cargo.lock
index c1fd278b8e..c1ad0694b5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1042,6 +1042,7 @@ dependencies = [
  "clap",
  "color-eyre",
  "council-server",
+ "si-std",
  "telemetry-application",
  "tokio",
  "tokio-util",
@@ -2906,6 +2907,7 @@ dependencies = [
  "clap",
  "color-eyre",
  "module-index-server",
+ "si-std",
  "telemetry-application",
  "tokio",
  "tokio-util",
@@ -3629,6 +3631,7 @@ dependencies = [
  "clap",
  "color-eyre",
  "pinga-server",
+ "si-std",
  "telemetry-application",
  "tokio",
  "tokio-util",
@@ -4487,6 +4490,7 @@ dependencies = [
  "color-eyre",
  "nats-multiplexer",
  "sdf-server",
+ "si-std",
  "telemetry-application",
  "tokio",
  "tokio-util",
@@ -6441,6 +6445,7 @@ version = "0.1.0"
 dependencies = [
  "clap",
  "color-eyre",
+ "si-std",
  "telemetry-application",
  "tokio",
  "tokio-util",
diff --git a/bin/council/BUCK b/bin/council/BUCK
index bc7a7c8900..41bec15c7c 100644
--- a/bin/council/BUCK
+++ b/bin/council/BUCK
@@ -9,6 +9,7 @@ rust_binary(
     name = "council",
     deps = [
         "//lib/council-server:council-server",
+        "//lib/si-std:si-std",
         "//lib/telemetry-application-rs:telemetry-application",
         "//third-party/rust:clap",
         "//third-party/rust:color-eyre",
diff --git a/bin/council/Cargo.toml b/bin/council/Cargo.toml
index a08eea21b3..4e1797c380 100644
--- a/bin/council/Cargo.toml
+++ b/bin/council/Cargo.toml
@@ -13,6 +13,7 @@ path = "src/main.rs"
 clap = { workspace = true }
 color-eyre = { workspace = true }
 council-server = { path = "../../lib/council-server" }
+si-std = { path = "../../lib/si-std" }
 telemetry-application = { path = "../../lib/telemetry-application-rs" }
 tokio = { workspace = true }
 tokio-util = { workspace = true }
diff --git a/bin/council/src/args.rs b/bin/council/src/args.rs
index d08b42e858..e112833924 100644
--- a/bin/council/src/args.rs
+++ b/bin/council/src/args.rs
@@ -1,6 +1,9 @@
+use std::path::PathBuf;
+
 use clap::{ArgAction, Parser};
 
 use council_server::server::config::{Config, ConfigError, ConfigFile, StandardConfigFile};
+use si_std::SensitiveString;
 
 const NAME: &str = "council";
 
@@ -60,11 +63,11 @@ pub(crate) struct Args {
 
     /// NATS credentials string
     #[arg(long, allow_hyphen_values = true)]
-    pub(crate) nats_creds: Option<String>,
+    pub(crate) nats_creds: Option<SensitiveString>,
 
     /// NATS credentials file
     #[arg(long)]
-    pub(crate) nats_creds_path: Option<String>,
+    pub(crate) nats_creds_path: Option<PathBuf>,
 }
 
 impl TryFrom<Args> for Config {
@@ -76,10 +79,10 @@ impl TryFrom<Args> for Config {
                 config_map.set("nats.url", url);
             }
             if let Some(creds) = args.nats_creds {
-                config_map.set("nats.creds", creds);
+                config_map.set("nats.creds", creds.to_string());
             }
             if let Some(creds_file) = args.nats_creds_path {
-                config_map.set("nats.creds_file", creds_file);
+                config_map.set("nats.creds_file", creds_file.display().to_string());
             }
             config_map.set("nats.connection_name", NAME);
         })?
diff --git a/bin/council/src/main.rs b/bin/council/src/main.rs
index 270a915de9..c5f94d9447 100644
--- a/bin/council/src/main.rs
+++ b/bin/council/src/main.rs
@@ -50,7 +50,7 @@ async fn async_main() -> Result<()> {
             .set_verbosity_and_wait(args.verbose.into())
             .await?;
     }
-    trace!(arguments =?args, "parsed cli arguments");
+    debug!(arguments =?args, "parsed cli arguments");
 
     let (_shutdown_request_tx, shutdown_request_rx) = watch::channel(());
 
diff --git a/bin/cyclone/src/main.rs b/bin/cyclone/src/main.rs
index f52a9ecffb..06517ca6c4 100644
--- a/bin/cyclone/src/main.rs
+++ b/bin/cyclone/src/main.rs
@@ -45,7 +45,7 @@ async fn main() -> Result<()> {
             .set_verbosity_and_wait(args.verbose.into())
             .await?;
     }
-    trace!(arguments =?args, "parsed cli arguments");
+    debug!(arguments =?args, "parsed cli arguments");
 
     let decryption_key = Server::load_decryption_key(&args.decryption_key).await?;
 
diff --git a/bin/module-index/BUCK b/bin/module-index/BUCK
index b66c3fafb3..ae2fc829d9 100644
--- a/bin/module-index/BUCK
+++ b/bin/module-index/BUCK
@@ -9,6 +9,7 @@ rust_binary(
     name = "module-index",
     deps = [
         "//lib/module-index-server:module-index-server",
+        "//lib/si-std:si-std",
         "//lib/telemetry-application-rs:telemetry-application",
         "//third-party/rust:clap",
         "//third-party/rust:color-eyre",
diff --git a/bin/module-index/Cargo.toml b/bin/module-index/Cargo.toml
index f52baec2f8..cfa4733f56 100644
--- a/bin/module-index/Cargo.toml
+++ b/bin/module-index/Cargo.toml
@@ -13,6 +13,7 @@ path = "src/main.rs"
 clap = { workspace = true }
 color-eyre = { workspace = true }
 module-index-server = { path = "../../lib/module-index-server" }
+si-std = { path = "../../lib/si-std" }
 telemetry-application = { path = "../../lib/telemetry-application-rs" }
 tokio = { workspace = true }
 tokio-util = { workspace = true }
diff --git a/bin/module-index/src/args.rs b/bin/module-index/src/args.rs
index ff3aecb7d2..4f4233b768 100644
--- a/bin/module-index/src/args.rs
+++ b/bin/module-index/src/args.rs
@@ -1,5 +1,8 @@
+use std::path::PathBuf;
+
 use clap::{ArgAction, Parser};
 use module_index_server::{Config, ConfigError, ConfigFile, StandardConfigFile};
+use si_std::SensitiveString;
 
 const NAME: &str = "module_index";
 
@@ -78,15 +81,15 @@ pub(crate) struct Args {
 
     /// PostgreSQL connection pool password [example: dbuser]
     #[arg(long, env)]
-    pub(crate) pg_password: Option<String>,
+    pub(crate) pg_password: Option<SensitiveString>,
 
     /// PostgreSQL connection certification path
     #[arg(long)]
-    pub(crate) pg_cert_path: Option<String>,
+    pub(crate) pg_cert_path: Option<PathBuf>,
 
     /// PostgreSQL connection certification base64 string
     #[arg(long)]
-    pub(crate) pg_cert_base64: Option<String>,
+    pub(crate) pg_cert_base64: Option<SensitiveString>,
 
     /// The address and port to bind the HTTP server to [example: 0.0.0.0:80]
     #[arg(long, env)]
@@ -94,7 +97,7 @@ pub(crate) struct Args {
 
     /// The s3 bucket access key id
     #[arg(long, env)]
-    pub(crate) s3_access_key_id: Option<String>,
+    pub(crate) s3_access_key_id: Option<SensitiveString>,
 
     /// The s3 bucket
     #[arg(long, env)]
@@ -106,7 +109,7 @@ pub(crate) struct Args {
 
     /// The s3 bucket secret access key
     #[arg(long, env)]
-    pub(crate) s3_secret_access_key: Option<String>,
+    pub(crate) s3_secret_access_key: Option<SensitiveString>,
 
     /// The s3 bucket path prefix
     #[arg(long, env)]
@@ -114,7 +117,7 @@ pub(crate) struct Args {
 
     /// The path to the JWT public signing key
     #[arg(long, env)]
-    pub(crate) jwt_public_key: Option<String>,
+    pub(crate) jwt_public_key: Option<SensitiveString>,
     // /// Database migration mode on startup
     // #[arg(long, value_parser = PossibleValuesParser::new(MigrationMode::variants()))]
 }
@@ -140,23 +143,23 @@ impl TryFrom<Args> for Config {
                 config_map.set("pg.user", user);
             }
             if let Some(password) = args.pg_password {
-                config_map.set("pg.password", password);
+                config_map.set("pg.password", password.to_string());
             }
-            if let Some(cert) = args.pg_cert_path {
-                config_map.set("pg.certificate_path", cert);
+            if let Some(cert_path) = args.pg_cert_path {
+                config_map.set("pg.certificate_path", cert_path.display().to_string());
             }
             if let Some(cert) = args.pg_cert_base64 {
-                config_map.set("pg.certificate_base64", cert);
+                config_map.set("pg.certificate_base64", cert.to_string());
             }
             if let Some(socket_addr) = args.socket_addr {
                 config_map.set("socket_addr", socket_addr);
             }
 
             if let Some(s3_access_key_id) = args.s3_access_key_id {
-                config_map.set("s3.access_key_id", s3_access_key_id);
+                config_map.set("s3.access_key_id", s3_access_key_id.to_string());
             }
             if let Some(s3_secret_access_key) = args.s3_secret_access_key {
-                config_map.set("s3.secret_access_key", s3_secret_access_key);
+                config_map.set("s3.secret_access_key", s3_secret_access_key.to_string());
             }
             if let Some(s3_bucket) = args.s3_bucket {
                 config_map.set("s3.bucket", s3_bucket);
@@ -168,7 +171,7 @@ impl TryFrom<Args> for Config {
                 config_map.set("s3.path_prefix", s3_path_prefix);
             }
             if let Some(jwt_public_key) = args.jwt_public_key {
-                config_map.set("jwt_signing_public_key_path", jwt_public_key);
+                config_map.set("jwt_signing_public_key_path", jwt_public_key.to_string());
             }
 
             // if let Some(migration_mode) = args.migration_mode {
diff --git a/bin/module-index/src/main.rs b/bin/module-index/src/main.rs
index a7a9e7d30f..0f4d1f7ff1 100644
--- a/bin/module-index/src/main.rs
+++ b/bin/module-index/src/main.rs
@@ -50,7 +50,7 @@ async fn async_main() -> Result<()> {
             .set_verbosity_and_wait(args.verbose.into())
             .await?;
     }
-    trace!(arguments =?args, "parsed cli arguments");
+    debug!(arguments =?args, "parsed cli arguments");
 
     let config = Config::try_from(args)?;
 
diff --git a/bin/pinga/BUCK b/bin/pinga/BUCK
index d229ad3cd5..181bf77cc2 100644
--- a/bin/pinga/BUCK
+++ b/bin/pinga/BUCK
@@ -9,6 +9,7 @@ rust_binary(
     name = "pinga",
     deps = [
         "//lib/pinga-server:pinga-server",
+        "//lib/si-std:si-std",
         "//lib/telemetry-application-rs:telemetry-application",
         "//third-party/rust:clap",
         "//third-party/rust:color-eyre",
diff --git a/bin/pinga/Cargo.toml b/bin/pinga/Cargo.toml
index da418652c2..c57787fc5e 100644
--- a/bin/pinga/Cargo.toml
+++ b/bin/pinga/Cargo.toml
@@ -13,6 +13,7 @@ path = "src/main.rs"
 clap = { workspace = true }
 color-eyre = { workspace = true }
 pinga-server = { path = "../../lib/pinga-server" }
+si-std = { path = "../../lib/si-std" }
 telemetry-application = { path = "../../lib/telemetry-application-rs" }
 tokio = { workspace = true }
 tokio-util = { workspace = true }
diff --git a/bin/pinga/src/args.rs b/bin/pinga/src/args.rs
index db522bfa93..57f408a27d 100644
--- a/bin/pinga/src/args.rs
+++ b/bin/pinga/src/args.rs
@@ -1,5 +1,8 @@
+use std::path::PathBuf;
+
 use clap::{ArgAction, Parser};
 use pinga_server::{Config, ConfigError, ConfigFile, StandardConfigFile};
+use si_std::SensitiveString;
 
 const NAME: &str = "pinga";
 
@@ -78,11 +81,11 @@ pub(crate) struct Args {
 
     /// PostgreSQL connection certification path
     #[arg(long)]
-    pub(crate) pg_cert_path: Option<String>,
+    pub(crate) pg_cert_path: Option<PathBuf>,
 
     /// PostgreSQL connection certification base64 string
     #[arg(long)]
-    pub(crate) pg_cert_base64: Option<String>,
+    pub(crate) pg_cert_base64: Option<SensitiveString>,
 
     /// NATS connection URL [example: demo.nats.io]
     #[arg(long)]
@@ -90,23 +93,23 @@ pub(crate) struct Args {
 
     /// NATS credentials string
     #[arg(long, allow_hyphen_values = true)]
-    pub(crate) nats_creds: Option<String>,
+    pub(crate) nats_creds: Option<SensitiveString>,
 
     /// NATS credentials file
     #[arg(long)]
-    pub(crate) nats_creds_path: Option<String>,
+    pub(crate) nats_creds_path: Option<PathBuf>,
 
     /// Cyclone encryption key file location [default: /run/pinga/cyclone_encryption.key]
     #[arg(long)]
-    pub(crate) cyclone_encryption_key_path: Option<String>,
+    pub(crate) cyclone_encryption_key_path: Option<PathBuf>,
 
     /// Cyclone encryption key file contents as a base64 encoded string
     #[arg(long)]
-    pub(crate) cyclone_encryption_key_base64: Option<String>,
+    pub(crate) cyclone_encryption_key_base64: Option<SensitiveString>,
 
     /// Cyclone secret key as base64 string
     #[arg(long)]
-    pub(crate) cyclone_secret_key_base64: Option<String>,
+    pub(crate) cyclone_secret_key_base64: Option<SensitiveString>,
 
     /// The number of concurrent jobs that can be processed [default: 10]
     #[arg(long)]
@@ -140,32 +143,38 @@ impl TryFrom<Args> for Config {
             if let Some(user) = args.pg_user {
                 config_map.set("pg.user", user);
             }
-            if let Some(cert) = args.pg_cert_path {
-                config_map.set("pg.certificate_path", cert);
+            if let Some(cert_path) = args.pg_cert_path {
+                config_map.set("pg.certificate_path", cert_path.display().to_string());
             }
             if let Some(cert) = args.pg_cert_base64 {
-                config_map.set("pg.certificate_base64", cert);
+                config_map.set("pg.certificate_base64", cert.to_string());
             }
             if let Some(url) = args.nats_url {
                 config_map.set("nats.url", url);
             }
             if let Some(creds) = args.nats_creds {
-                config_map.set("nats.creds", creds);
+                config_map.set("nats.creds", creds.to_string());
             }
-            if let Some(creds_file) = args.nats_creds_path {
-                config_map.set("nats.creds_file", creds_file);
+            if let Some(creds_path) = args.nats_creds_path {
+                config_map.set("nats.creds_file", creds_path.display().to_string());
             }
             if let Some(cyclone_encryption_key_file) = args.cyclone_encryption_key_path {
-                config_map.set("crypto.encryption_key_file", cyclone_encryption_key_file);
+                config_map.set(
+                    "crypto.encryption_key_file",
+                    cyclone_encryption_key_file.display().to_string(),
+                );
             }
             if let Some(cyclone_encryption_key_base64) = args.cyclone_encryption_key_base64 {
                 config_map.set(
                     "crypto.encryption_key_base64",
-                    cyclone_encryption_key_base64,
+                    cyclone_encryption_key_base64.to_string(),
                 );
             }
             if let Some(secret_string) = args.cyclone_secret_key_base64 {
-                config_map.set("symmetric_crypto_service.active_key_base64", secret_string);
+                config_map.set(
+                    "symmetric_crypto_service.active_key_base64",
+                    secret_string.to_string(),
+                );
             }
             if let Some(concurrency) = args.concurrency {
                 config_map.set("concurrency_limit", i64::from(concurrency));
diff --git a/bin/pinga/src/main.rs b/bin/pinga/src/main.rs
index fec381b455..dd9ba4d285 100644
--- a/bin/pinga/src/main.rs
+++ b/bin/pinga/src/main.rs
@@ -50,7 +50,7 @@ async fn async_main() -> Result<()> {
             .set_verbosity_and_wait(args.verbose.into())
             .await?;
     }
-    trace!(arguments =?args, "parsed cli arguments");
+    debug!(arguments =?args, "parsed cli arguments");
 
     let config = Config::try_from(args)?;
 
diff --git a/bin/sdf/BUCK b/bin/sdf/BUCK
index 32a6a6df76..c1e732a7de 100644
--- a/bin/sdf/BUCK
+++ b/bin/sdf/BUCK
@@ -10,6 +10,7 @@ rust_binary(
     deps = [
         "//lib/nats-multiplexer:nats-multiplexer",
         "//lib/sdf-server:sdf-server",
+        "//lib/si-std:si-std",
         "//lib/telemetry-application-rs:telemetry-application",
         "//third-party/rust:clap",
         "//third-party/rust:color-eyre",
diff --git a/bin/sdf/Cargo.toml b/bin/sdf/Cargo.toml
index ae8d117944..a4ab96c772 100644
--- a/bin/sdf/Cargo.toml
+++ b/bin/sdf/Cargo.toml
@@ -10,11 +10,11 @@ name = "sdf"
 path = "src/main.rs"
 
 [dependencies]
+clap = { workspace = true }
+color-eyre = { workspace = true }
 nats-multiplexer = { path = "../../lib/nats-multiplexer" }
 sdf-server = { path = "../../lib/sdf-server" }
+si-std = { path = "../../lib/si-std" }
 telemetry-application = { path = "../../lib/telemetry-application-rs" }
-
-clap = { workspace = true }
-color-eyre = { workspace = true }
 tokio = { workspace = true }
 tokio-util = { workspace = true }
diff --git a/bin/sdf/src/args.rs b/bin/sdf/src/args.rs
index bb19940f57..a0e72ccd0a 100644
--- a/bin/sdf/src/args.rs
+++ b/bin/sdf/src/args.rs
@@ -2,6 +2,7 @@ use std::path::PathBuf;
 
 use clap::{builder::PossibleValuesParser, ArgAction, Parser};
 use sdf_server::{Config, ConfigError, ConfigFile, MigrationMode, StandardConfigFile};
+use si_std::SensitiveString;
 
 const NAME: &str = "sdf";
 
@@ -80,11 +81,11 @@ pub(crate) struct Args {
 
     /// PostgreSQL connection certification path
     #[arg(long)]
-    pub(crate) pg_cert_path: Option<String>,
+    pub(crate) pg_cert_path: Option<PathBuf>,
 
     /// PostgreSQL connection certification base64 string
     #[arg(long)]
-    pub(crate) pg_cert_base64: Option<String>,
+    pub(crate) pg_cert_base64: Option<SensitiveString>,
 
     /// NATS connection URL [example: demo.nats.io]
     #[arg(long)]
@@ -92,11 +93,11 @@ pub(crate) struct Args {
 
     /// NATS credentials string
     #[arg(long, allow_hyphen_values = true)]
-    pub(crate) nats_creds: Option<String>,
+    pub(crate) nats_creds: Option<SensitiveString>,
 
     /// NATS credentials file
     #[arg(long)]
-    pub(crate) nats_creds_path: Option<String>,
+    pub(crate) nats_creds_path: Option<PathBuf>,
 
     /// Database migration mode on startup
     #[arg(long, value_parser = PossibleValuesParser::new(MigrationMode::variants()))]
@@ -104,19 +105,19 @@ pub(crate) struct Args {
 
     /// Cyclone encryption key file location [default: /run/sdf/cyclone_encryption.key]
     #[arg(long)]
-    pub(crate) cyclone_encryption_key_path: Option<String>,
+    pub(crate) cyclone_encryption_key_path: Option<PathBuf>,
 
     /// Cyclone encryption key file contents
     #[arg(long)]
-    pub(crate) cyclone_encryption_key_base64: Option<String>,
+    pub(crate) cyclone_encryption_key_base64: Option<SensitiveString>,
 
     /// Cyclone secret key as base64 string
     #[arg(long)]
-    pub(crate) cyclone_secret_key_base64: Option<String>,
+    pub(crate) cyclone_secret_key_base64: Option<SensitiveString>,
 
     /// jwt public signing key as a base64 string
     #[arg(long)]
-    pub(crate) jwt_public_signing_key_base64: Option<String>,
+    pub(crate) jwt_public_signing_key_base64: Option<SensitiveString>,
 
     /// Generates cyclone secret key file (does not run server)
     ///
@@ -179,11 +180,11 @@ impl TryFrom<Args> for Config {
             if let Some(user) = args.pg_user {
                 config_map.set("pg.user", user);
             }
-            if let Some(cert) = args.pg_cert_path {
-                config_map.set("pg.certificate_path", cert);
+            if let Some(cert_path) = args.pg_cert_path {
+                config_map.set("pg.certificate_path", cert_path.display().to_string());
             }
             if let Some(cert) = args.pg_cert_base64 {
-                config_map.set("pg.certificate_base64", cert);
+                config_map.set("pg.certificate_base64", cert.to_string());
             }
             if let Some(migration_mode) = args.migration_mode {
                 config_map.set("migration_mode", migration_mode);
@@ -192,25 +193,31 @@ impl TryFrom<Args> for Config {
                 config_map.set("nats.url", url);
             }
             if let Some(creds) = args.nats_creds {
-                config_map.set("nats.creds", creds);
+                config_map.set("nats.creds", creds.to_string());
             }
             if let Some(creds_file) = args.nats_creds_path {
-                config_map.set("nats.creds_file", creds_file);
+                config_map.set("nats.creds_file", creds_file.display().to_string());
             }
             if let Some(cyclone_encryption_key_file) = args.cyclone_encryption_key_path {
-                config_map.set("crypto.encryption_key_file", cyclone_encryption_key_file);
+                config_map.set(
+                    "crypto.encryption_key_file",
+                    cyclone_encryption_key_file.display().to_string(),
+                );
             }
             if let Some(cyclone_encryption_key_base64) = args.cyclone_encryption_key_base64 {
                 config_map.set(
                     "crypto.encryption_key_base64",
-                    cyclone_encryption_key_base64,
+                    cyclone_encryption_key_base64.to_string(),
                 );
             }
             if let Some(secret_string) = args.cyclone_secret_key_base64 {
-                config_map.set("symmetric_crypto_service.active_key_base64", secret_string);
+                config_map.set(
+                    "symmetric_crypto_service.active_key_base64",
+                    secret_string.to_string(),
+                );
             }
             if let Some(jwt) = args.jwt_public_signing_key_base64 {
-                config_map.set("jwt_signing_public_key.key_base64", jwt);
+                config_map.set("jwt_signing_public_key.key_base64", jwt.to_string());
             }
             if let Some(pkgs_path) = args.pkgs_path {
                 config_map.set("pkgs_path", pkgs_path);
diff --git a/bin/sdf/src/main.rs b/bin/sdf/src/main.rs
index 0c43106e66..c85fb17a48 100644
--- a/bin/sdf/src/main.rs
+++ b/bin/sdf/src/main.rs
@@ -61,7 +61,7 @@ async fn async_main() -> Result<()> {
             .set_verbosity_and_wait(args.verbose.into())
             .await?;
     }
-    trace!(arguments =?args, "parsed cli arguments");
+    debug!(arguments =?args, "parsed cli arguments");
 
     Server::init()?;
 
diff --git a/bin/veritech/BUCK b/bin/veritech/BUCK
index 337d057d25..a73f8d4ec6 100644
--- a/bin/veritech/BUCK
+++ b/bin/veritech/BUCK
@@ -30,8 +30,9 @@ rust_binary(
     name = "veritech",
     edition = "2021",
     deps = [
-        "//lib/veritech-server:veritech-server",
+        "//lib/si-std:si-std",
         "//lib/telemetry-application-rs:telemetry-application",
+        "//lib/veritech-server:veritech-server",
         "//third-party/rust:clap",
         "//third-party/rust:color-eyre",
         "//third-party/rust:tokio",
diff --git a/bin/veritech/Cargo.toml b/bin/veritech/Cargo.toml
index 2879416ac5..ba3e1e3164 100644
--- a/bin/veritech/Cargo.toml
+++ b/bin/veritech/Cargo.toml
@@ -12,6 +12,7 @@ path = "src/main.rs"
 [dependencies]
 clap = { workspace = true }
 color-eyre = { workspace = true }
+si-std = { path = "../../lib/si-std" }
 telemetry-application = { path = "../../lib/telemetry-application-rs" }
 tokio = { workspace = true }
 tokio-util = { workspace = true }
diff --git a/bin/veritech/src/args.rs b/bin/veritech/src/args.rs
index 12f9709ba9..05afb0539e 100644
--- a/bin/veritech/src/args.rs
+++ b/bin/veritech/src/args.rs
@@ -1,4 +1,7 @@
+use std::path::PathBuf;
+
 use clap::{ArgAction, Parser};
+use si_std::SensitiveString;
 use veritech_server::{Config, ConfigError, ConfigFile, StandardConfigFile};
 
 const NAME: &str = "veritech";
@@ -58,11 +61,11 @@ pub(crate) struct Args {
 
     /// NATS credentials string
     #[arg(long, allow_hyphen_values = true)]
-    pub(crate) nats_creds: Option<String>,
+    pub(crate) nats_creds: Option<SensitiveString>,
 
     /// NATS credentials file
     #[arg(long)]
-    pub(crate) nats_creds_path: Option<String>,
+    pub(crate) nats_creds_path: Option<PathBuf>,
 
     /// Cyclone runtime type: LocalProcess
     #[arg(long)]
@@ -94,10 +97,10 @@ impl TryFrom<Args> for Config {
                 config_map.set("nats.url", url);
             }
             if let Some(creds) = args.nats_creds {
-                config_map.set("nats.creds", creds);
+                config_map.set("nats.creds", creds.to_string());
             }
             if let Some(creds_file) = args.nats_creds_path {
-                config_map.set("nats.creds_file", creds_file);
+                config_map.set("nats.creds_file", creds_file.display().to_string());
             }
             if args.cyclone_local_firecracker {
                 config_map.set("cyclone.runtime_strategy", "LocalFirecracker");
diff --git a/bin/veritech/src/main.rs b/bin/veritech/src/main.rs
index 4e05944ad6..af802fa235 100644
--- a/bin/veritech/src/main.rs
+++ b/bin/veritech/src/main.rs
@@ -36,7 +36,7 @@ async fn main() -> Result<()> {
             .set_verbosity_and_wait(args.verbose.into())
             .await?;
     }
-    trace!(arguments =?args, "parsed cli arguments");
+    debug!(arguments =?args, "parsed cli arguments");
 
     let config = Config::try_from(args)?;