diff --git a/compose/config/serialize.py b/compose/config/serialize.py
index aaaf053995c..040973ae080 100644
--- a/compose/config/serialize.py
+++ b/compose/config/serialize.py
@@ -51,7 +51,10 @@ def denormalize_config(config, image_digests=None):
             del vol_conf['external_name']
 
     if config.version in (V3_1, V3_2):
-        result['secrets'] = config.secrets
+        result['secrets'] = config.secrets.copy()
+        for secret_name, secret_conf in result['secrets'].items():
+            if 'external_name' in secret_conf:
+                del secret_conf['external_name']
     return result
 
 
diff --git a/tests/unit/config/config_test.py b/tests/unit/config/config_test.py
index 6bf4986ff56..d3087fffe46 100644
--- a/tests/unit/config/config_test.py
+++ b/tests/unit/config/config_test.py
@@ -3825,7 +3825,8 @@ def test_serialize_secrets(self):
         }
         secrets_dict = {
             'one': {'file': '/one.txt'},
-            'source': {'file': '/source.pem'}
+            'source': {'file': '/source.pem'},
+            'two': {'external': True},
         }
         config_dict = config.load(build_config_details({
             'version': '3.1',
@@ -3837,6 +3838,7 @@ def test_serialize_secrets(self):
         serialized_service = serialized_config['services']['web']
         assert secret_sort(serialized_service['secrets']) == secret_sort(service_dict['secrets'])
         assert 'secrets' in serialized_config
+        assert serialized_config['secrets']['two'] == secrets_dict['two']
 
     def test_serialize_ports(self):
         config_dict = config.Config(version='2.0', services=[