diff --git a/plugins/catalog-backend/migrations/20220616202842_refresh_keys.js b/plugins/catalog-backend/migrations/20220616202842_refresh_keys.js
index 800ce4d0e4..a7ec819489 100644
--- a/plugins/catalog-backend/migrations/20220616202842_refresh_keys.js
+++ b/plugins/catalog-backend/migrations/20220616202842_refresh_keys.js
@@ -32,12 +32,13 @@ exports.up = async function up(knex) {
       .onDelete('CASCADE')
       .comment('A reference to the entity that the refresh key is tied to');
     table
-      .text('key')
+      .string('key')
       .notNullable()
       .comment(
         'A reference to a key which should be used to trigger a refresh on this entity',
       );
     table.index('entity_id', 'refresh_keys_entity_id_idx');
+    table.index('key', 'refresh_keys_key_idx');
   });
 };
 
diff --git a/plugins/catalog-backend/src/database/DefaultProcessingDatabase.ts b/plugins/catalog-backend/src/database/DefaultProcessingDatabase.ts
index 56d143e374..8bf93e5c91 100644
--- a/plugins/catalog-backend/src/database/DefaultProcessingDatabase.ts
+++ b/plugins/catalog-backend/src/database/DefaultProcessingDatabase.ts
@@ -51,6 +51,7 @@ import { DateTime } from 'luxon';
 import { CATALOG_CONFLICTS_TOPIC } from '../constants';
 import { CatalogConflictEventPayload } from '../catalog/types';
 import { LoggerService } from '@backstage/backend-plugin-api';
+import { createHash } from 'crypto';
 
 // The number of items that are sent per batch to the database layer, when
 // doing .batchInsert calls to knex. This needs to be low enough to not cause
@@ -158,7 +159,7 @@ export class DefaultProcessingDatabase implements ProcessingDatabase {
       'refresh_keys',
       refreshKeys.map(k => ({
         entity_id: id,
-        key: k.key,
+        key: createHash('sha256').update(k.key).digest('hex'),
       })),
       BATCH_SIZE,
     );
diff --git a/plugins/catalog-backend/src/database/operations/provider/refreshByRefreshKeys.ts b/plugins/catalog-backend/src/database/operations/provider/refreshByRefreshKeys.ts
index dc34c9cdf0..ac36550864 100644
--- a/plugins/catalog-backend/src/database/operations/provider/refreshByRefreshKeys.ts
+++ b/plugins/catalog-backend/src/database/operations/provider/refreshByRefreshKeys.ts
@@ -16,6 +16,7 @@
 
 import { Knex } from 'knex';
 import { DbRefreshStateRow } from '../../tables';
+import { createHash } from 'crypto';
 
 /**
  * Schedules a future refresh of entities, by so called "refresh keys" that may
@@ -30,10 +31,14 @@ export async function refreshByRefreshKeys(options: {
 }): Promise<void> {
   const { tx, keys } = options;
 
+  const hashedKeys = keys.map(k =>
+    createHash('sha256').update(k).digest('hex'),
+  );
+
   await tx<DbRefreshStateRow>('refresh_state')
     .whereIn('entity_id', function selectEntityRefs(inner) {
       inner
-        .whereIn('key', keys)
+        .whereIn('key', hashedKeys)
         .select({
           entity_id: 'refresh_keys.entity_id',
         })