The secret was always stored encrypted, but the setup form wiped the input on every load. Load it back for admins (GitHub App parity) so a reload no longer looks like a failed save.