diff --git a/awx/conf/models.py b/awx/conf/models.py
index 5c26e17c54..afdacb1757 100644
--- a/awx/conf/models.py
+++ b/awx/conf/models.py
@@ -65,8 +65,10 @@ class Setting(CreatedModifiedModel):
         # After saving a new instance for the first time, set the encrypted
         # field and save again.
         if encrypted and new_instance:
-            self.value = self._saved_value
-            self.save(update_fields=['value'])
+            from awx.main.signals import disable_activity_stream
+            with disable_activity_stream():
+                self.value = self._saved_value
+                self.save(update_fields=['value'])
 
     @classmethod
     def get_cache_key(self, key):
diff --git a/awx/main/utils/common.py b/awx/main/utils/common.py
index 1005ad74c8..58d795567f 100644
--- a/awx/main/utils/common.py
+++ b/awx/main/utils/common.py
@@ -16,6 +16,7 @@ import urlparse
 import threading
 import contextlib
 import tempfile
+import six
 
 # Decorator
 from decorator import decorator
@@ -325,7 +326,10 @@ def _convert_model_field_for_display(obj, field_name, password_fields=None):
         return '<missing {}>-{}'.format(obj._meta.verbose_name, getattr(obj, '{}_id'.format(field_name)))
     if password_fields is None:
         password_fields = set(getattr(type(obj), 'PASSWORD_FIELDS', [])) | set(['password'])
-    if field_name in password_fields:
+    if field_name in password_fields or (
+        isinstance(field_val, six.string_types) and
+        field_val.startswith('$encrypted$')
+    ):
         return u'hidden'
     if hasattr(obj, 'display_%s' % field_name):
         field_val = getattr(obj, 'display_%s' % field_name)()