Puppet-Passwords as plain text in Windows agent output and in catalog file

Question

I encrypted password using hiera:

dsc_xADUser {'FirstUser':
 
            dsc_ensure => 'present',
            dsc_domainname => 'ad.contoso.com',
            dsc_username   => 'tfl',
            dsc_userprincipalname => '[email protected]',
            dsc_password   => {
            'user' => '[email protected]',
            'password' => Sensitive(lookup('password'))
            },
            dsc_passwordneverexpires => true,
            dsc_domainadministratorcredential => {
            'user'  => '[email protected]',
            'password' => Sensitive(lookup('password'))
            },
 
        }

but on node,when running agent -t -v password is shown as plain text in agent output and in catalog JSON file.

I also tried node_encrypt(lookup('password')) then getting content of my encrypted password (which is good) and windows complains that password doesn't meet password complexity (bad-because it's trying to set all below as password)

 'password' = '-----BEGIN PKCS7-----
    MIIMyQYJKoZIhvcNAQcDoIIMujCCDLYCAQAxggKdMIICmQIBADCBgjB9MXsweQYD
    VQQDDHJQdXBwZXQgRW50ZXJwcmlzZSBDQSBnZW5lcmF0ZWQgb24gbXlwdXBwZXQt
    eGwwZGJ5a212Z2xrYnl2eS5ldS13ZXN0LTEub3Bzd29ya3MtY20uaW8gYXQgKzIw
    MTgtMTEtMDIgMTQ6MDQ6MDAgKzAwMDACAQUwCwYJKoZIhvcNAQEBBIICABkJDfGb
    4CdHUntrVR1E......

hiera config:

---
version: 5
defaults:
  datadir: data
  data_hash: yaml_data
 
hierarchy:
  - name: "Eyaml hierarchy"
    lookup_key: eyaml_lookup_key # eyaml backend
    paths:
      - "nodes/%{trusted.certname}.yaml"
      - "windowspass.eyaml"
    options:
        pkcs7_private_key: "/etc/puppetlabs/puppet/keys/private_key.pkcs7.pem"
        pkcs7_public_key: "/etc/puppetlabs/puppet/keys/public_key.pkcs7.pem"

EDIT: just found this, it seems it's opened issue and related to Windows only

UPDATE: i managed to configure puppet not to cache catalog file on Windows client (adding catalog_cache_terminus="" to puppet config file on windows so i'll use this as "workaround", it seems no way to remove passwords from agent debug output