diff --git a/scripts/travis.sh b/scripts/travis.sh
index 84a227a..7359a0c 100755
--- a/scripts/travis.sh
+++ b/scripts/travis.sh
@@ -25,6 +25,9 @@
     if [[ $TRAVIS_SECURE_ENV_VARS == "true" ]]; then
         echo 'Extracting secrets.'
         scripts/decrypt-secrets.sh "$SECRETS_PASSWORD"
+        # Prevent build failures from leaking our password.
+        # looking at you, Tox.
+        export SECRETS_PASSWORD=""
     else
         # This is an external PR, so just mark system tests as green.
         echo 'In system test but secrets are not available, skipping.'