diff --git a/src/cleveragents/application/services/config_service.py b/src/cleveragents/application/services/config_service.py
index 050642f5e..ad789a643 100644
--- a/src/cleveragents/application/services/config_service.py
+++ b/src/cleveragents/application/services/config_service.py
@@ -23,6 +23,7 @@ import tomlkit
 
 from cleveragents.infrastructure.events.models import DomainEvent
 from cleveragents.infrastructure.events.types import EventType
+from cleveragents.shared.redaction import REDACTED, is_sensitive_key
 
 if TYPE_CHECKING:
     from cleveragents.infrastructure.events.protocol import EventBus
@@ -1165,6 +1166,9 @@ class ConfigService:
         old_value = data.get(key)
         data[key] = value
         self.write_config(data)
+        if is_sensitive_key(key):
+            old_value = REDACTED
+            value = REDACTED
         if self._event_bus is not None:
             try:
                 self._event_bus.emit(
diff --git a/src/cleveragents/shared/redaction.py b/src/cleveragents/shared/redaction.py
index 019795328..1d693f7d0 100644
--- a/src/cleveragents/shared/redaction.py
+++ b/src/cleveragents/shared/redaction.py
@@ -27,6 +27,7 @@ REDACTED = "***REDACTED***"
 _SENSITIVE_SUBSTRINGS: set[str] = {
     "api_key",
     "apikey",
+    "api-key",
     "password",
     "passwd",
     "secret",