diff --git a/.changeset/hungry-buckets-compare.md b/.changeset/hungry-buckets-compare.md
new file mode 100644
index 0000000000..c70f38bfb7
--- /dev/null
+++ b/.changeset/hungry-buckets-compare.md
@@ -0,0 +1,5 @@
+---
+'@backstage/backend-app-api': patch
+---
+
+Ensure redaction of secrets that have accidental extra whitespace around them
diff --git a/packages/backend-app-api/src/logging/WinstonLogger.test.ts b/packages/backend-app-api/src/logging/WinstonLogger.test.ts
index e05e47ee1d..c7173b1cbe 100644
--- a/packages/backend-app-api/src/logging/WinstonLogger.test.ts
+++ b/packages/backend-app-api/src/logging/WinstonLogger.test.ts
@@ -30,7 +30,7 @@ describe('WinstonLogger', () => {
       stack: 'hello (world) from this file',
     };
     expect(redacter.format.transform(msg(log))).toEqual(msg(log));
-    redacter.add(['hello']);
+    redacter.add(['hello\n']);
     expect(redacter.format.transform(msg(log))).toEqual(
       msg({
         ...log,
diff --git a/packages/backend-app-api/src/logging/WinstonLogger.ts b/packages/backend-app-api/src/logging/WinstonLogger.ts
index bfceb5b2f2..7dd0ed80b0 100644
--- a/packages/backend-app-api/src/logging/WinstonLogger.ts
+++ b/packages/backend-app-api/src/logging/WinstonLogger.ts
@@ -89,7 +89,11 @@ export class WinstonLogger implements RootLoggerService {
       })(),
       add(newRedactions) {
         let added = 0;
-        for (const redaction of newRedactions) {
+        for (const redactionToTrim of newRedactions) {
+          // Trimming the string ensures that we don't accdentally get extra
+          // newlines or other whitespace interfering with the redaction; this
+          // can happen for example when using string literals in yaml
+          const redaction = redactionToTrim.trim();
           // Exclude secrets that are empty or just one character in length. These
           // typically mean that you are running local dev or tests, or using the
           // --lax flag which sets things to just 'x'.