diff --git a/terraform/outputs.tf b/terraform/outputs.tf
index 0668e69..f0d259e 100644
--- a/terraform/outputs.tf
+++ b/terraform/outputs.tf
@@ -15,7 +15,9 @@ output "cloudfront_domain_name" {
 
 output "cloudfront_web_acl_id" {
   description = "WAFv2 WebACL ARN associated with the distribution (SSM /seahaven/waf/app-web-acl-arn)"
-  value       = aws_cloudfront_distribution.site.web_acl_id
+  # SSM String params are sensitive by default in the AWS provider; the WebACL ARN is not a secret.
+  value     = nonsensitive(aws_cloudfront_distribution.site.web_acl_id)
+  sensitive = false
 }
 
 output "github_deploy_role_arn" {