diff --git a/contrib/oauth2-proxy.cfg.example b/contrib/oauth2-proxy.cfg.example
index cb0e8dcb..1ce434d6 100644
--- a/contrib/oauth2-proxy.cfg.example
+++ b/contrib/oauth2-proxy.cfg.example
@@ -27,6 +27,7 @@
 #logging_max_age = 7
 #logging_local_time = true
 #logging_compress = false
+#sensible_logging = false
 #standard_logging = true
 #standard_logging_format = "[{{.Timestamp}}] [{{.File}}] {{.Message}}"
 #request_logging = true
diff --git a/pkg/apis/options/logging.go b/pkg/apis/options/logging.go
index 3ed79127..a26b6e1b 100644
--- a/pkg/apis/options/logging.go
+++ b/pkg/apis/options/logging.go
@@ -35,6 +35,7 @@ func loggingFlagSet() *pflag.FlagSet {
 
 	flagSet.Bool("auth-logging", true, "Log authentication attempts")
 	flagSet.String("auth-logging-format", logger.DefaultAuthLoggingFormat, "Template for authentication log lines")
+	flagSet.Bool("sensible-logging", false, "Log sensible data")
 	flagSet.Bool("standard-logging", true, "Log standard runtime information")
 	flagSet.String("standard-logging-format", logger.DefaultStandardLoggingFormat, "Template for standard log lines")
 	flagSet.Bool("request-logging", true, "Log HTTP requests")