diff --git a/proto/dam/v1/dam_secrets.proto b/proto/dam/v1/dam_secrets.proto
index 69280b4..e2aca6d 100644
--- a/proto/dam/v1/dam_secrets.proto
+++ b/proto/dam/v1/dam_secrets.proto
@@ -18,6 +18,8 @@ syntax = "proto3";
 // end points to receive requests and returns responses using these messages.
 package dam.v1;
 
+import "storage/datapol/annotations/proto/semantic_annotations.proto";
+
 option go_package = "github.com/GoogleCloudPlatform/healthcare-federated-access-services/proto/dam/v1";
 
 message DamSecrets {
@@ -30,7 +32,7 @@ message DamSecrets {
   map<string, string> public_token_keys = 5 [deprecated = true];
 
   message GatekeeperTokenKeys {
-    string private_key = 1;
+    string private_key = 1 [(datapol.semantic_type) = ST_SECURITY_MATERIAL];
     string public_key = 2;
   }
   GatekeeperTokenKeys gatekeeper_token_keys = 6 [deprecated = true];
diff --git a/proto/dam/v1/dam_service.proto b/proto/dam/v1/dam_service.proto
index 79cc76b..a0b1f7c 100644
--- a/proto/dam/v1/dam_service.proto
+++ b/proto/dam/v1/dam_service.proto
@@ -18,6 +18,7 @@ syntax = "proto3";
 // end points to receive requests and returns responses using these messages.
 package dam.v1;
 
+import "storage/datapol/annotations/proto/semantic_annotations.proto";
 import "proto/common/v1/common.proto"; /* copybara-comment */
 import "proto/common/v1/oauthclient.proto"; /* copybara-comment */
 import "proto/process/v1/process.proto"; /* copybara-comment */
@@ -382,7 +383,7 @@ message ConfigViewRequest {
 message ConfigTrustedIssuerRequest {
   TrustedIssuer item = 1;
   // client_secret is write only field.
-  string client_secret = 3;
+  string client_secret = 3 [(datapol.semantic_type) = ST_SECURITY_MATERIAL];
   ConfigModification modification = 2;
 }