diff --git a/backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts b/backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts
index a171b39b5..99ce2d25f 100644
--- a/backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts
+++ b/backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts
@@ -41,7 +41,10 @@ export interface SqlResourceConnection {
    *
    * @returns Promise to be resolved with the new credentials
    */
-  rotateCredentials: (currentCredentials: TSqlAccountCredentials) => Promise<TSqlAccountCredentials>;
+  rotateCredentials: (
+    currentCredentials: TSqlAccountCredentials,
+    newPassword: string
+  ) => Promise<TSqlAccountCredentials>;
 
   /**
    * Close the connection.
@@ -113,8 +116,7 @@ const makeSqlConnection = (
             });
           }
         },
-        rotateCredentials: async (currentCredentials) => {
-          const newPassword = alphaNumericNanoId(32);
+        rotateCredentials: async (currentCredentials, newPassword) => {
           // Note: The generated random password is not really going to make SQL Injection possible.
           //       The reason we are not using parameters binding is that the "ALTER USER" syntax is DDL,
           //       parameters binding is not supported. But just in case if the this code got copied
@@ -295,6 +297,7 @@ export const sqlResourceFactory: TPamResourceFactory<TSqlResourceConnectionDetai
     rotationAccountCredentials,
     currentCredentials
   ) => {
+    const newPassword = alphaNumericNanoId(32);
     try {
       return await executeWithGateway(
         {
@@ -305,7 +308,7 @@ export const sqlResourceFactory: TPamResourceFactory<TSqlResourceConnectionDetai
           password: rotationAccountCredentials.password
         },
         gatewayV2Service,
-        (client) => client.rotateCredentials(currentCredentials)
+        (client) => client.rotateCredentials(currentCredentials, newPassword)
       );
     } catch (error) {
       if (error instanceof BadRequestError) {
@@ -328,8 +331,10 @@ export const sqlResourceFactory: TPamResourceFactory<TSqlResourceConnectionDetai
         }
       }
 
+      const sanitizedErrorMessage = ((error as Error).message || String(error)).replaceAll(newPassword, "REDACTED");
+
       throw new BadRequestError({
-        message: `Unable to rotate account credentials for ${resourceType}: ${(error as Error).message || String(error)}`
+        message: `Unable to rotate account credentials for ${resourceType}: ${sanitizedErrorMessage}`
       });
     }
   };