diff --git a/scripts/sql/manage_storage.php b/scripts/sql/manage_storage.php
index ab547c38b5..4661fc9f1f 100755
--- a/scripts/sql/manage_storage.php
+++ b/scripts/sql/manage_storage.php
@@ -38,7 +38,6 @@ $args->parseStandardArguments();
 $conf = PhabricatorEnv::newObjectFromConfig('mysql.configuration-provider');
 
 $default_user       = $conf->getUser();
-$default_password   = $conf->getPassword();
 $default_host       = $conf->getHost();
 $default_namespace  = PhabricatorLiskDAO::getDefaultStorageNamespace();
 
@@ -62,7 +61,6 @@ try {
         'name'    => 'password',
         'short'   => 'p',
         'param'   => 'password',
-        'default' => $default_password,
         'help'    => 'Use __password__ instead of the configured default.',
       ),
       array(
@@ -85,10 +83,18 @@ try {
   exit(77);
 }
 
+if ($args->getArg('password') === null) {
+  // This is already a PhutilOpaqueEnvelope.
+  $password = $conf->getPassword();
+} else {
+  // Put this in a PhutilOpaqueEnvelope.
+  $password = new PhutilOpaqueEnvelope($args->getArg('password'));
+}
+
 $api = new PhabricatorStorageManagementAPI();
 $api->setUser($args->getArg('user'));
 $api->setHost($default_host);
-$api->setPassword($args->getArg('password'));
+$api->setPassword($password);
 $api->setNamespace($args->getArg('namespace'));
 
 try {
diff --git a/src/infrastructure/storage/configuration/DefaultDatabaseConfigurationProvider.php b/src/infrastructure/storage/configuration/DefaultDatabaseConfigurationProvider.php
index 55b8989b26..9439c92765 100644
--- a/src/infrastructure/storage/configuration/DefaultDatabaseConfigurationProvider.php
+++ b/src/infrastructure/storage/configuration/DefaultDatabaseConfigurationProvider.php
@@ -38,7 +38,7 @@ final class DefaultDatabaseConfigurationProvider
   }
 
   public function getPassword() {
-    return PhabricatorEnv::getEnvConfig('mysql.pass');
+    return new PhutilOpaqueEnvelope(PhabricatorEnv::getEnvConfig('mysql.pass'));
   }
 
   public function getHost() {
diff --git a/src/infrastructure/storage/connection/mysql/AphrontMySQLDatabaseConnection.php b/src/infrastructure/storage/connection/mysql/AphrontMySQLDatabaseConnection.php
index 016b686afd..2a61c08d6e 100644
--- a/src/infrastructure/storage/connection/mysql/AphrontMySQLDatabaseConnection.php
+++ b/src/infrastructure/storage/connection/mysql/AphrontMySQLDatabaseConnection.php
@@ -52,7 +52,11 @@ final class AphrontMySQLDatabaseConnection
     $user = $this->getConfiguration('user');
     $host = $this->getConfiguration('host');
     $database = $this->getConfiguration('database');
+
     $pass = $this->getConfiguration('pass');
+    if ($pass instanceof PhutilOpaqueEnvelope) {
+      $pass = $pass->openEnvelope();
+    }
 
     $conn = @mysql_connect(
       $host,
diff --git a/src/infrastructure/storage/connection/mysql/AphrontMySQLiDatabaseConnection.php b/src/infrastructure/storage/connection/mysql/AphrontMySQLiDatabaseConnection.php
index 6892a2f5ab..0e3fac234a 100644
--- a/src/infrastructure/storage/connection/mysql/AphrontMySQLiDatabaseConnection.php
+++ b/src/infrastructure/storage/connection/mysql/AphrontMySQLiDatabaseConnection.php
@@ -50,7 +50,11 @@ final class AphrontMySQLiDatabaseConnection
     $user = $this->getConfiguration('user');
     $host = $this->getConfiguration('host');
     $database = $this->getConfiguration('database');
+
     $pass = $this->getConfiguration('pass');
+    if ($pass instanceof PhutilOpaqueEnvelope) {
+      $pass = $pass->openEnvelope();
+    }
 
     $conn = @new mysqli(
       $host,