I did try specifying

AdditionalSecretOutputs

on the resource property I wanted hidden, but that didn't do anything and I still got a plaintext string as the output.