diff --git a/litellm/proxy/management_endpoints/ui_sso.py b/litellm/proxy/management_endpoints/ui_sso.py
index eb01f938bb0..5e474cfea44 100644
--- a/litellm/proxy/management_endpoints/ui_sso.py
+++ b/litellm/proxy/management_endpoints/ui_sso.py
@@ -4228,13 +4228,15 @@ async def debug_sso_callback(request: Request):
         )
 
     elif okta_client_id is not None:
-        result, _, _ = await get_generic_sso_response(
-            request=request,
-            jwt_handler=jwt_handler,
-            generic_client_id=okta_client_id,
-            redirect_url=redirect_url,
-            sso_jwt_handler=sso_jwt_handler,
-            provider=_OIDC_PROVIDER_OKTA,
+        result, received_response, access_token_payload = (
+            await get_generic_sso_response(
+                request=request,
+                jwt_handler=jwt_handler,
+                generic_client_id=okta_client_id,
+                redirect_url=redirect_url,
+                sso_jwt_handler=sso_jwt_handler,
+                provider=_OIDC_PROVIDER_OKTA,
+            )
         )
 
     elif generic_client_id is not None:
diff --git a/litellm/proxy/ui_crud_endpoints/proxy_setting_endpoints.py b/litellm/proxy/ui_crud_endpoints/proxy_setting_endpoints.py
index 23e37c81e83..d5a7ac15d96 100644
--- a/litellm/proxy/ui_crud_endpoints/proxy_setting_endpoints.py
+++ b/litellm/proxy/ui_crud_endpoints/proxy_setting_endpoints.py
@@ -928,10 +928,17 @@ async def update_sso_settings(sso_config: SSOConfig):
             detail={"error": f"Error updating environment_variables: {str(e)}"},
         )
 
+    # Redact secret fields in the response so plaintext secrets (including any
+    # restored from the sentinel) never leak back to the caller.
+    redacted_sso_data = {**sso_data}
+    for _secret_field in _SSO_SECRET_FIELDS:
+        if redacted_sso_data.get(_secret_field):
+            redacted_sso_data[_secret_field] = _REDACTED_SECRET
+
     return {
         "message": "SSO settings updated successfully",
         "status": "success",
-        "settings": sso_data,
+        "settings": redacted_sso_data,
     }
 
 
diff --git a/tests/test_litellm/proxy/ui_crud_endpoints/test_proxy_setting_endpoints.py b/tests/test_litellm/proxy/ui_crud_endpoints/test_proxy_setting_endpoints.py
index 87cf9e30c35..2365099f8bb 100644
--- a/tests/test_litellm/proxy/ui_crud_endpoints/test_proxy_setting_endpoints.py
+++ b/tests/test_litellm/proxy/ui_crud_endpoints/test_proxy_setting_endpoints.py
@@ -430,16 +430,13 @@ class TestProxySettingEndpoints:
         # Verify settings were updated
         settings = data["settings"]
         assert settings["google_client_id"] == new_sso_settings["google_client_id"]
-        assert (
-            settings["google_client_secret"] == new_sso_settings["google_client_secret"]
-        )
+        # Secret fields must be redacted in the response so plaintext does not
+        # leak back to the caller.
+        assert settings["google_client_secret"] == "**redacted**"
         assert (
             settings["microsoft_client_id"] == new_sso_settings["microsoft_client_id"]
         )
-        assert (
-            settings["microsoft_client_secret"]
-            == new_sso_settings["microsoft_client_secret"]
-        )
+        assert settings["microsoft_client_secret"] == "**redacted**"
         assert settings["proxy_base_url"] == new_sso_settings["proxy_base_url"]
         assert settings["user_email"] == new_sso_settings["user_email"]