diff --git a/lib/puppet/pops/evaluator/deferred_resolver.rb b/lib/puppet/pops/evaluator/deferred_resolver.rb
index 6c4bf989693..7aa9699fe93 100644
--- a/lib/puppet/pops/evaluator/deferred_resolver.rb
+++ b/lib/puppet/pops/evaluator/deferred_resolver.rb
@@ -89,17 +89,25 @@ def resolve_futures(catalog)
       overrides = {}
       r.parameters.each_pair do |k, v|
         resolved = resolve(v)
-        # If the value is instance of Sensitive - assign the unwrapped value
-        # and mark it as sensitive if not already marked
-        #
         case resolved
         when Puppet::Pops::Types::PSensitiveType::Sensitive
+          # If the resolved value is instance of Sensitive - assign the unwrapped value
+          # and mark it as sensitive if not already marked
+          #
           resolved = resolved.unwrap
           mark_sensitive_parameters(r, k)
-        # If the value is a DeferredValue and it has an argument of type PSensitiveType, mark it as sensitive
-        # The DeferredValue.resolve method will unwrap it during catalog application
+
         when Puppet::Pops::Evaluator::DeferredValue
-          if v.arguments.any? { |arg| arg.is_a?(Puppet::Pops::Types::PSensitiveType) }
+          # If the resolved value is a DeferredValue and it has an argument of type
+          # PSensitiveType, mark it as sensitive. Since DeferredValues can nest,
+          # we must walk all arguments, e.g. the DeferredValue may call the `epp`
+          # function, where one of its arguments is a DeferredValue to call the
+          # `vault:lookup` function.
+          #
+          # The DeferredValue.resolve method will unwrap the sensitive during
+          # catalog application
+          #
+          if contains_sensitive_args(v)
             mark_sensitive_parameters(r, k)
           end
         end
@@ -109,6 +117,22 @@ def resolve_futures(catalog)
     end
   end
 
+  # Return true if x contains an argument of type PSensitiveType. It
+  # short-circuits as soon as a value is found.
+  #
+  def contains_sensitive_args(x)
+    if x.instance_of?(@deferred_class)
+      contains_sensitive_args(x.arguments)
+    elsif x.is_a?(Array)
+      x.any? { |v| contains_sensitive_args(v) }
+    elsif x.is_a?(Hash)
+      x.any? { |k, v| contains_sensitive_args(k) || contains_sensitive_args(v) }
+    elsif x.is_a?(Puppet::Pops::Types::PSensitiveType)
+      true
+    end
+  end
+  private :contains_sensitive_args
+
   def mark_sensitive_parameters(r, k)
     unless r.sensitive_parameters.include?(k.to_sym)
       r.sensitive_parameters = (r.sensitive_parameters + [k.to_sym]).freeze