diff --git a/esphome/__main__.py b/esphome/__main__.py
index cf2741dbdb..ea8f18c365 100644
--- a/esphome/__main__.py
+++ b/esphome/__main__.py
@@ -414,7 +414,9 @@ def command_config(args, config):
     # add the console decoration so the front-end can hide the secrets
     if not args.show_secrets:
         output = re.sub(
-            r"(password|key|psk|ssid)\: (.+)", r"\1: \\033[5m\2\\033[6m", output
+            r"(password|key|psk|ssid)\: ((?!\!secret).+)",
+            r"\1: \\033[5m\2\\033[6m",
+            output,
         )
     if not CORE.quiet:
         safe_print(output)