diff --git a/manifests/init.pp b/manifests/init.pp
index 5991874b..4a022c9c 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -158,7 +158,7 @@
     Sensitive => $config_hash.unwrap,
     default   => $config_hash
   }
-  $config_hash_real = deep_merge($config_defaults, $config_hash)
+  $config_hash_real = deep_merge($config_defaults, $_config_hash)
 
   if $install_method == 'docker' {
     $user_real         = undef
diff --git a/manifests/install.pp b/manifests/install.pp
index c1bc7b2b..4a365184 100644
--- a/manifests/install.pp
+++ b/manifests/install.pp
@@ -4,7 +4,7 @@
 # @api private
 class consul::install {
   assert_private()
-  $real_data_dir = pick($consul::data_dir, $consul::config_hash[data_dir], $consul::config_defaults[data_dir])
+  $real_data_dir = pick($consul::data_dir, $consul::config_hash_real[data_dir], $consul::config_defaults[data_dir])
 
   if $consul::manage_data_dir {
     file { $real_data_dir:
diff --git a/spec/classes/init_spec.rb b/spec/classes/init_spec.rb
index fbfcb666..8aea1fc3 100644
--- a/spec/classes/init_spec.rb
+++ b/spec/classes/init_spec.rb
@@ -231,6 +231,16 @@
         it { is_expected.to contain_file('consul config').with_content(sensitive(%r{"ui":true})) }
       end
 
+      context 'When passing "config_hash" as Sensitive' do
+        let :params do
+          {
+            config_hash: RSpec::Puppet::RawString.new('Sensitive({})'),
+          }
+        end
+
+        it { is_expected.to compile.with_all_deps }
+      end
+
       context 'When not installing UI' do
         let(:params) do
           {