diff --git a/deploy/charts/disco-agent/README.md b/deploy/charts/disco-agent/README.md
index 3d4dce59..4404a398 100644
--- a/deploy/charts/disco-agent/README.md
+++ b/deploy/charts/disco-agent/README.md
@@ -419,7 +419,9 @@ This description will be associated with the data that the agent uploads to the
 > true
 > ```
 
-Enable sending of Secret values to CyberArk in addition to metadata. Metadata is always sent, but the actual values of Secrets are not sent by default. When enabled, Secret data is encrypted using envelope encryption using a key managed by CyberArk, fetched from the Discovery and Context service.
+Enable sending of Secret values to CyberArk in addition to metadata. Metadata is always sent, and Secret values are sent by default too.  
+Set this to false to send metadata only.  
+When enabled, Secret data is encrypted using envelope encryption using a key managed by CyberArk, fetched from the Discovery and Context service.
 #### **config.cyberark.serviceId** ~ `string`
 > Default value:
 > ```yaml
diff --git a/deploy/charts/disco-agent/templates/deployment.yaml b/deploy/charts/disco-agent/templates/deployment.yaml
index 63e09ba0..0d3e1d17 100644
--- a/deploy/charts/disco-agent/templates/deployment.yaml
+++ b/deploy/charts/disco-agent/templates/deployment.yaml
@@ -86,7 +86,7 @@ spec:
                 key: ARK_SECRET
                 optional: true
           - name: ARK_SEND_SECRET_VALUES
-            value: {{ .Values.config.sendSecretValues | default "false" | quote }}
+            value: {{ .Values.config.sendSecretValues | quote }}
           {{- with .Values.http_proxy }}
           - name: HTTP_PROXY
             value: {{ . }}
diff --git a/deploy/charts/disco-agent/values.schema.json b/deploy/charts/disco-agent/values.schema.json
index 1087a483..a5d3c48b 100644
--- a/deploy/charts/disco-agent/values.schema.json
+++ b/deploy/charts/disco-agent/values.schema.json
@@ -200,7 +200,7 @@
     },
     "helm-values.config.sendSecretValues": {
       "default": true,
-      "description": "Enable sending of Secret values to CyberArk in addition to metadata. Metadata is always sent, but the actual values of Secrets are not sent by default. When enabled, Secret data is encrypted using envelope encryption using a key managed by CyberArk, fetched from the Discovery and Context service.",
+      "description": "Enable sending of Secret values to CyberArk in addition to metadata. Metadata is always sent, and Secret values are sent by default too.\nSet this to false to send metadata only.\nWhen enabled, Secret data is encrypted using envelope encryption using a key managed by CyberArk, fetched from the Discovery and Context service.",
       "type": "boolean"
     },
     "helm-values.extraArgs": {
diff --git a/deploy/charts/disco-agent/values.yaml b/deploy/charts/disco-agent/values.yaml
index 805d6c83..e9df3484 100644
--- a/deploy/charts/disco-agent/values.yaml
+++ b/deploy/charts/disco-agent/values.yaml
@@ -200,7 +200,8 @@ config:
   clusterDescription: ""
 
   # Enable sending of Secret values to CyberArk in addition to metadata.
-  # Metadata is always sent, but the actual values of Secrets are not sent by default.
+  # Metadata is always sent, and Secret values are sent by default too.
+  # Set this to false to send metadata only.
   # When enabled, Secret data is encrypted using envelope encryption using
   # a key managed by CyberArk, fetched from the Discovery and Context service.
   sendSecretValues: true
diff --git a/docs/datagatherers/k8s-dynamic.md b/docs/datagatherers/k8s-dynamic.md
index da8767a8..cd8b8f59 100644
--- a/docs/datagatherers/k8s-dynamic.md
+++ b/docs/datagatherers/k8s-dynamic.md
@@ -77,7 +77,7 @@ Secrets can be gathered using the following config:
       resource: secrets
 ```
 
-Before Secrets are sent to the Preflight backend, they are redacted so no secret data is transmitted. See [`fieldfilter.go`](./../../pkg/datagatherer/k8s/fieldfilter.go) to see the details of which fields are filtered and which ones are redacted.
+By default, Secret `data` is redacted before being sent to the backend, keeping only non-sensitive fields (`tls.crt`, `ca.crt`, `conjur-map`). If `sendSecretValues` is enabled, the full `data` is kept and encrypted before being sent instead. See [`fieldfilter.go`](./../../pkg/datagatherer/k8sdynamic/fieldfilter.go) for the field list, and `sendSecretValues` in the [disco-agent chart](./../../deploy/charts/disco-agent/README.md) for the encryption behaviour.
 
 > **All resource other than Kubernetes Secrets are sent in full, so make sure that you don't store secret information on arbitrary resources.**