diff --git a/implementation/src/main/java/io/smallrye/config/SecretKeysHandlerConfigSourceInterceptor.java b/implementation/src/main/java/io/smallrye/config/SecretKeysHandlerConfigSourceInterceptor.java
index 0eacabfd5..0de6dc3d6 100644
--- a/implementation/src/main/java/io/smallrye/config/SecretKeysHandlerConfigSourceInterceptor.java
+++ b/implementation/src/main/java/io/smallrye/config/SecretKeysHandlerConfigSourceInterceptor.java
@@ -7,9 +7,11 @@
 public class SecretKeysHandlerConfigSourceInterceptor implements ConfigSourceInterceptor {
     private static final long serialVersionUID = -5228028387733656005L;
 
+    private final boolean enabled;
     private final Map<String, SecretKeysHandler> handlers = new HashMap<>();
 
-    public SecretKeysHandlerConfigSourceInterceptor(final List<SecretKeysHandler> handlers) {
+    public SecretKeysHandlerConfigSourceInterceptor(final boolean enabled, final List<SecretKeysHandler> handlers) {
+        this.enabled = enabled;
         for (SecretKeysHandler handler : handlers) {
             this.handlers.put(handler.getName(), handler);
         }
@@ -18,7 +20,7 @@ public SecretKeysHandlerConfigSourceInterceptor(final List<SecretKeysHandler> ha
     @Override
     public ConfigValue getValue(final ConfigSourceInterceptorContext context, final String name) {
         ConfigValue configValue = context.proceed(name);
-        if (configValue != null && configValue.getValue() != null) {
+        if (enabled && configValue != null && configValue.getValue() != null) {
             String handler = configValue.getExtendedExpressionHandler();
             if (handler != null) {
                 return configValue.withValue(getSecretValue(handler, configValue.getValue()));
diff --git a/implementation/src/main/java/io/smallrye/config/SmallRyeConfigBuilder.java b/implementation/src/main/java/io/smallrye/config/SmallRyeConfigBuilder.java
index c0ad807d6..7cdb7b02f 100644
--- a/implementation/src/main/java/io/smallrye/config/SmallRyeConfigBuilder.java
+++ b/implementation/src/main/java/io/smallrye/config/SmallRyeConfigBuilder.java
@@ -323,7 +323,8 @@ public ConfigSourceInterceptor getInterceptor(final ConfigSourceInterceptorConte
                 if (isAddDiscoveredSecretKeysHandlers()) {
                     secretKeysHandlers.addAll(discoverSecretKeysHandlers(context));
                 }
-                return new SecretKeysHandlerConfigSourceInterceptor(secretKeysHandlers);
+                return new SecretKeysHandlerConfigSourceInterceptor(
+                        isAddDiscoveredSecretKeysHandlers() || !secretKeysHandlers.isEmpty(), secretKeysHandlers);
             }
 
             @Override
@@ -611,6 +612,11 @@ public SmallRyeConfigBuilder setAddDiscoveredInterceptors(final boolean addDisco
         return this;
     }
 
+    public SmallRyeConfigBuilder setAddDiscoveredSecretKeysHandlers(final boolean addDiscoveredSecretKeysHandlers) {
+        this.addDiscoveredSecretKeysHandlers = addDiscoveredSecretKeysHandlers;
+        return this;
+    }
+
     public SmallRyeConfigBuilder setAddDiscoveredValidator(final boolean addDiscoveredValidator) {
         this.addDiscoveredValidator = addDiscoveredValidator;
         return this;
diff --git a/implementation/src/test/java/io/smallrye/config/SecretKeysHandlerTest.java b/implementation/src/test/java/io/smallrye/config/SecretKeysHandlerTest.java
index 95cb18046..a39a04d51 100644
--- a/implementation/src/test/java/io/smallrye/config/SecretKeysHandlerTest.java
+++ b/implementation/src/test/java/io/smallrye/config/SecretKeysHandlerTest.java
@@ -1,6 +1,7 @@
 package io.smallrye.config;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
 import java.util.NoSuchElementException;
@@ -12,6 +13,7 @@ class SecretKeysHandlerTest {
     void notFound() {
         SmallRyeConfig config = new SmallRyeConfigBuilder()
                 .addDefaultInterceptors()
+                .addDiscoveredSecretKeysHandlers()
                 .withDefaultValue("my.secret", "${missing::secret}")
                 .build();
 
@@ -38,4 +40,15 @@ public String getName() {
 
         assertEquals("decoded", config.getRawValue("my.secret"));
     }
+
+    @Test
+    void disabled() {
+        SmallRyeConfig config = new SmallRyeConfigBuilder()
+                .addDefaultInterceptors()
+                .setAddDiscoveredSecretKeysHandlers(false)
+                .withDefaultValue("my.secret", "${handler::secret}")
+                .build();
+
+        assertNotNull(config.getRawValue("my.secret"));
+    }
 }