diff --git a/enos/modules/aws_windows_client/main.tf b/enos/modules/aws_windows_client/main.tf
index 5e936da058..adf64685ff 100644
--- a/enos/modules/aws_windows_client/main.tf
+++ b/enos/modules/aws_windows_client/main.tf
@@ -275,7 +275,6 @@ resource "aws_instance" "client" {
 }
 
 locals {
-  admin_password        = rsadecrypt(aws_instance.client.password_data, tls_private_key.rsa-4096-key.private_key_pem)
   boundary_cli_zip_path = var.boundary_cli_zip_path != "" ? abspath(var.boundary_cli_zip_path) : ""
   test_dir              = "C:/Test/" # needs to end in a / to ensure it creates the directory
 }
diff --git a/enos/modules/aws_windows_client/outputs.tf b/enos/modules/aws_windows_client/outputs.tf
index 2e9c0bdc4a..9164e71479 100644
--- a/enos/modules/aws_windows_client/outputs.tf
+++ b/enos/modules/aws_windows_client/outputs.tf
@@ -26,7 +26,7 @@ output "admin_username" {
 // This is the decrypted administrator password for the EC2 instance
 output "admin_password" {
   description = "The password for the administrator account"
-  value       = nonsensitive(local.admin_password)
+  value       = nonsensitive(rsadecrypt(aws_instance.client.password_data, tls_private_key.rsa-4096-key.private_key_pem))
 }
 
 output "test_username" {
@@ -35,7 +35,7 @@ output "test_username" {
 }
 output "test_password" {
   description = "The password of the test account"
-  value       = nonsensitive(rsadecrypt(aws_instance.client.password_data, tls_private_key.rsa-4096-key.private_key_pem))
+  value       = nonsensitive(local.test_password)
 }
 
 output "test_dir" {