diff --git a/internal/options/secret_string.go b/internal/options/secret_string.go
index 26e8da5af..107127612 100644
--- a/internal/options/secret_string.go
+++ b/internal/options/secret_string.go
@@ -13,12 +13,15 @@ func (s SecretString) GoString() string {
 }
 
 func (s SecretString) String() string {
-	if len(*s.s) == 0 {
+	if s.s == nil || len(*s.s) == 0 {
 		return ``
 	}
 	return `**redacted**`
 }
 
 func (s *SecretString) Unwrap() string {
+	if s.s == nil {
+		return ""
+	}
 	return *s.s
 }
diff --git a/internal/options/secret_string_test.go b/internal/options/secret_string_test.go
index 7e616ab50..a2ca01746 100644
--- a/internal/options/secret_string_test.go
+++ b/internal/options/secret_string_test.go
@@ -53,3 +53,11 @@ func TestSecretStringEmpty(t *testing.T) {
 	test.Equals(t, `""`, fmt.Sprintf("%#v", secret))
 	test.Equals(t, keyStr, secret.Unwrap())
 }
+
+func TestSecretStringDefault(t *testing.T) {
+	secretStruct := &secretTest{}
+
+	test.Equals(t, "", secretStruct.str.String())
+	test.Equals(t, `""`, secretStruct.str.GoString())
+	test.Equals(t, "", secretStruct.str.Unwrap())
+}