diff --git a/packages/@aws-cdk/custom-resources/lib/provider-framework/runtime/framework.ts b/packages/@aws-cdk/custom-resources/lib/provider-framework/runtime/framework.ts
index f9586e032ae5f..97b7c4de61e4b 100644
--- a/packages/@aws-cdk/custom-resources/lib/provider-framework/runtime/framework.ts
+++ b/packages/@aws-cdk/custom-resources/lib/provider-framework/runtime/framework.ts
@@ -105,7 +105,9 @@ async function invokeUserFunction<A extends { ResponseURL: '...' }>(functionArnE
   // automatically by the JavaScript SDK.
   const resp = await invokeFunction({
     FunctionName: functionArn,
-    Payload: JSON.stringify(sanitizedPayload),
+
+    // Strip 'ResponseURL' -- the downstream CR doesn't need it and can only log it by accident
+    Payload: JSON.stringify({ ...sanitizedPayload, ResponseURL: undefined }),
   });
 
   log('user function response:', resp, typeof(resp));