diff --git a/internal/gen/controller/servers/services/credential.pb.go b/internal/gen/controller/servers/services/credential.pb.go
index 85b71ddd58..b6162c85bf 100644
--- a/internal/gen/controller/servers/services/credential.pb.go
+++ b/internal/gen/controller/servers/services/credential.pb.go
@@ -126,7 +126,7 @@ func (*Credential_SshCertificate) isCredential_Credential() {}
 type UsernamePassword struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// The username of the credential
-	Username string `protobuf:"bytes,10,opt,name=username,proto3" json:"username,omitempty"` // @gotags: `class:"public"`
+	Username string `protobuf:"bytes,10,opt,name=username,proto3" json:"username,omitempty"` // @gotags: `class:"sensitive"`
 	// The password of the credential
 	Password      string `protobuf:"bytes,20,opt,name=password,proto3" json:"password,omitempty"` // @gotags: `class:"secret"`
 	unknownFields protoimpl.UnknownFields
diff --git a/internal/proto/controller/api/resources/sessionrecordings/v1/session_recording.proto b/internal/proto/controller/api/resources/sessionrecordings/v1/session_recording.proto
index 5eb48f66ff..90866e07d6 100644
--- a/internal/proto/controller/api/resources/sessionrecordings/v1/session_recording.proto
+++ b/internal/proto/controller/api/resources/sessionrecordings/v1/session_recording.proto
@@ -314,7 +314,7 @@ message Credential {
 // The attributes of a UsernamePassword Credential.
 message UsernamePasswordCredentialAttributes {
   // The username associated with the credential.
-  string username = 1; // @gotags: class:"public"
+  string username = 1; // @gotags: class:"sensitive"
 
   // The hmac value of the password.
   string password_hmac = 2; // @gotags: class:"public"
diff --git a/internal/proto/controller/servers/services/v1/credential.proto b/internal/proto/controller/servers/services/v1/credential.proto
index 331adc5c77..63e11bc8ba 100644
--- a/internal/proto/controller/servers/services/v1/credential.proto
+++ b/internal/proto/controller/servers/services/v1/credential.proto
@@ -21,7 +21,7 @@ message Credential {
 // UsernamePassword is a credential containing a username and a password.
 message UsernamePassword {
   // The username of the credential
-  string username = 10; // @gotags: `class:"public"`
+  string username = 10; // @gotags: `class:"sensitive"`
 
   // The password of the credential
   string password = 20; // @gotags: `class:"secret"`
diff --git a/sdk/pbs/controller/api/resources/session_recordings/session_recording.pb.go b/sdk/pbs/controller/api/resources/session_recordings/session_recording.pb.go
index 6cf8d9f412..efa8ef1ddd 100644
--- a/sdk/pbs/controller/api/resources/session_recordings/session_recording.pb.go
+++ b/sdk/pbs/controller/api/resources/session_recordings/session_recording.pb.go
@@ -1285,7 +1285,7 @@ func (*Credential_JsonAttributes) isCredential_Attrs() {}
 type UsernamePasswordCredentialAttributes struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// The username associated with the credential.
-	Username string `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty" class:"public"` // @gotags: class:"public"
+	Username string `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty" class:"sensitive"` // @gotags: class:"sensitive"
 	// The hmac value of the password.
 	PasswordHmac  string `protobuf:"bytes,2,opt,name=password_hmac,json=passwordHmac,proto3" json:"password_hmac,omitempty" class:"public"` // @gotags: class:"public"
 	unknownFields protoimpl.UnknownFields