diff --git a/core/inputs.go b/core/inputs.go
index b236022..11ca446 100644
--- a/core/inputs.go
+++ b/core/inputs.go
@@ -703,23 +703,27 @@ func ConvertToString(c *ExecutionState, elem reflect.Value) (string, error) {
 		}
 		return str.String(), nil
 	case reflect.Struct:
-		dsf, ok := elem.Interface().(DataStreamFactory)
-		if !ok {
-			return "", CreateErr(c, nil, "cannot convert '%s' to string", elem.Kind())
-		}
 
-		bytes, err := io.ReadAll(dsf.Reader)
-		if err != nil {
-			dsf.CloseStreamAndIgnoreError()
-			return "", CreateErr(c, nil, "error reading from io.Reader: %s", err)
-		}
+		switch t := elem.Interface().(type) {
+		case DataStreamFactory:
+			bytes, err := io.ReadAll(t.Reader)
+			if err != nil {
+				t.CloseStreamAndIgnoreError()
+				return "", CreateErr(c, nil, "error reading from io.Reader: %s", err)
+			}
 
-		err = dsf.CloseStream()
-		if err != nil {
-			return "", CreateErr(c, nil, "error closing reader: %s", err)
-		}
+			err = t.CloseStream()
+			if err != nil {
+				return "", CreateErr(c, nil, "error closing reader: %s", err)
+			}
 
-		return string(bytes), nil
+			return string(bytes), nil
+		case SecretValue:
+			return t.Secret, nil
+		default:
+			// fallthrough to error handler
+			break
+		}
 	}
 
 	if elem.IsValid() {
diff --git a/nodes/secret-get@v1.go b/nodes/secret-get@v1.go
index 421065c..3f7598f 100644
--- a/nodes/secret-get@v1.go
+++ b/nodes/secret-get@v1.go
@@ -37,7 +37,9 @@ func (n *SecretNode) OutputValueById(c *core.ExecutionState, outputId core.Outpu
 		return "", nil
 	}
 
-	return fmt.Sprintf("%s%s", prefix, secretValue), nil
+	return core.SecretValue{
+		Secret: fmt.Sprintf("%s%s", prefix, secretValue),
+	}, nil
 }
 
 func init() {