diff --git a/internal/configs/named_values.go b/internal/configs/named_values.go
index bd5dedec63..4cbb3e9e98 100644
--- a/internal/configs/named_values.go
+++ b/internal/configs/named_values.go
@@ -144,6 +144,25 @@ func decodeVariableBlock(block *hcl.Block, override bool) (*Variable, hcl.Diagno
 		v.ConstSet = true
 	}
 
+	if v.Const {
+		if v.Sensitive {
+			diags = append(diags, &hcl.Diagnostic{
+				Severity: hcl.DiagError,
+				Summary:  "Const variable cannot be sensitive",
+				Detail:   "A variable that is marked as \"const\" cannot also be marked as \"sensitive\".",
+				Subject:  v.DeclRange.Ptr(),
+			})
+		}
+		if v.Ephemeral {
+			diags = append(diags, &hcl.Diagnostic{
+				Severity: hcl.DiagError,
+				Summary:  "Const variable cannot be ephemeral",
+				Detail:   "A variable that is marked as \"const\" cannot also be marked as \"ephemeral\".",
+				Subject:  v.DeclRange.Ptr(),
+			})
+		}
+	}
+
 	if attr, exists := content.Attributes["nullable"]; exists {
 		valDiags := gohcl.DecodeExpression(attr.Expr, nil, &v.Nullable)
 		diags = append(diags, valDiags...)
diff --git a/internal/configs/testdata/error-files/const-ephemeral-variable.tf b/internal/configs/testdata/error-files/const-ephemeral-variable.tf
new file mode 100644
index 0000000000..04423cd9f0
--- /dev/null
+++ b/internal/configs/testdata/error-files/const-ephemeral-variable.tf
@@ -0,0 +1,6 @@
+variable "example" { # ERROR: Const variable cannot be ephemeral
+  type      = string
+  default   = "hello"
+  const     = true
+  ephemeral = true
+}
diff --git a/internal/configs/testdata/error-files/const-sensitive-variable.tf b/internal/configs/testdata/error-files/const-sensitive-variable.tf
new file mode 100644
index 0000000000..2466f2a434
--- /dev/null
+++ b/internal/configs/testdata/error-files/const-sensitive-variable.tf
@@ -0,0 +1,6 @@
+variable "example" { # ERROR: Const variable cannot be sensitive
+  type      = string
+  default   = "hello"
+  const     = true
+  sensitive = true
+}