diff --git a/x-pack/plugins/fleet/common/experimental_features.ts b/x-pack/plugins/fleet/common/experimental_features.ts
index 233173263c129..3ac7abb927b95 100644
--- a/x-pack/plugins/fleet/common/experimental_features.ts
+++ b/x-pack/plugins/fleet/common/experimental_features.ts
@@ -23,8 +23,8 @@ export const allowedExperimentalValues = Object.freeze<Record<string, boolean>>(
   agentTamperProtectionEnabled: true,
   secretsStorage: true,
   kafkaOutput: true,
-  outputSecretsStorage: false,
-  remoteESOutput: false,
+  outputSecretsStorage: true,
+  remoteESOutput: true,
 });
 
 type ExperimentalConfigKeys = Array<keyof ExperimentalFeatures>;
diff --git a/x-pack/plugins/fleet/cypress/e2e/fleet_settings_outputs.cy.ts b/x-pack/plugins/fleet/cypress/e2e/fleet_settings_outputs.cy.ts
index c5cf05bc1edd3..3b312241fb70f 100644
--- a/x-pack/plugins/fleet/cypress/e2e/fleet_settings_outputs.cy.ts
+++ b/x-pack/plugins/fleet/cypress/e2e/fleet_settings_outputs.cy.ts
@@ -204,7 +204,7 @@ describe('Outputs', () => {
         cy.contains('Name is required');
         cy.contains('Host is required');
         cy.contains('Username is required');
-        cy.contains('Password is required');
+        // cy.contains('Password is required'); // TODO
         cy.contains('Default topic is required');
         cy.contains('Topic is required');
         cy.contains(
@@ -213,7 +213,7 @@ describe('Outputs', () => {
         cy.contains('Must be a key, value pair i.e. "http.response.code: 200"');
         shouldDisplayError(SETTINGS_OUTPUTS.NAME_INPUT);
         shouldDisplayError(SETTINGS_OUTPUTS_KAFKA.AUTHENTICATION_USERNAME_INPUT);
-        shouldDisplayError(SETTINGS_OUTPUTS_KAFKA.AUTHENTICATION_PASSWORD_INPUT);
+        // shouldDisplayError(SETTINGS_OUTPUTS_KAFKA.AUTHENTICATION_PASSWORD_INPUT); // TODO
         shouldDisplayError(SETTINGS_OUTPUTS_KAFKA.TOPICS_DEFAULT_TOPIC_INPUT);
         shouldDisplayError(SETTINGS_OUTPUTS_KAFKA.TOPICS_CONDITION_INPUT);
         shouldDisplayError(SETTINGS_OUTPUTS_KAFKA.TOPICS_TOPIC_INPUT);
@@ -271,7 +271,7 @@ describe('Outputs', () => {
       it('saves the output', () => {
         selectKafkaOutput();
 
-        fillInKafkaOutputForm();
+        fillInKafkaOutputForm(true);
 
         cy.intercept('POST', '**/api/fleet/outputs').as('saveOutput');
 
diff --git a/x-pack/plugins/fleet/cypress/screens/fleet.ts b/x-pack/plugins/fleet/cypress/screens/fleet.ts
index af799b6066600..fa623389e7c92 100644
--- a/x-pack/plugins/fleet/cypress/screens/fleet.ts
+++ b/x-pack/plugins/fleet/cypress/screens/fleet.ts
@@ -144,7 +144,7 @@ export const SETTINGS_OUTPUTS_KAFKA = {
   AUTHENTICATION_SSL_OPTION: 'kafkaAuthenticationSSLRadioButton',
   AUTHENTICATION_KERBEROS_OPTION: 'kafkaAuthenticationKerberosRadioButton',
   AUTHENTICATION_USERNAME_INPUT: 'settingsOutputsFlyout.kafkaUsernameInput',
-  AUTHENTICATION_PASSWORD_INPUT: 'settingsOutputsFlyout.kafkaPasswordInput',
+  AUTHENTICATION_PASSWORD_INPUT: 'settingsOutputsFlyout.kafkaPasswordSecretInput',
   AUTHENTICATION_VERIFICATION_MODE_INPUT: 'settingsOutputsFlyout.kafkaVerificationModeInput',
   AUTHENTICATION_CONNECTION_TYPE_SELECT: 'settingsOutputsFlyout.kafkaConnectionTypeRadioInput',
   AUTHENTICATION_CONNECTION_TYPE_PLAIN_OPTION: 'kafkaConnectionTypePlaintextRadioButton',
diff --git a/x-pack/plugins/fleet/cypress/screens/fleet_outputs.ts b/x-pack/plugins/fleet/cypress/screens/fleet_outputs.ts
index 8e7121877b8bf..5b3b0f8d4af16 100644
--- a/x-pack/plugins/fleet/cypress/screens/fleet_outputs.ts
+++ b/x-pack/plugins/fleet/cypress/screens/fleet_outputs.ts
@@ -176,16 +176,17 @@ export const resetKafkaOutputForm = () => {
   cy.getBySel(kafkaOutputFormValues.name.selector).clear();
   cy.get('[placeholder="Specify host"').clear();
   cy.getBySel(kafkaOutputFormValues.username.selector).clear();
-  cy.getBySel(kafkaOutputFormValues.password.selector).clear();
   cy.getBySel(kafkaOutputFormValues.defaultTopic.selector).clear();
   cy.getBySel(SETTINGS_OUTPUTS_KAFKA.COMPRESSION_SWITCH).click();
 };
 
-export const fillInKafkaOutputForm = () => {
+export const fillInKafkaOutputForm = (create?: boolean) => {
   cy.getBySel(kafkaOutputFormValues.name.selector).type(kafkaOutputFormValues.name.value);
   cy.get('[placeholder="Specify host"').clear().type('localhost:5000');
   cy.getBySel(kafkaOutputFormValues.username.selector).type(kafkaOutputFormValues.username.value);
-  cy.getBySel(kafkaOutputFormValues.password.selector).type(kafkaOutputFormValues.password.value);
+  if (create) {
+    cy.getBySel(kafkaOutputFormValues.password.selector).type(kafkaOutputFormValues.password.value);
+  }
   cy.getBySel(kafkaOutputFormValues.verificationMode.selector).select(
     kafkaOutputFormValues.verificationMode.value
   );
@@ -263,6 +264,9 @@ export const fillInKafkaOutputForm = () => {
 export const validateSavedKafkaOutputForm = () => {
   Object.keys(kafkaOutputFormValues).forEach((key: string) => {
     const { selector, value } = kafkaOutputFormValues[key as keyof typeof kafkaOutputFormValues];
+    if (selector === SETTINGS_OUTPUTS_KAFKA.AUTHENTICATION_PASSWORD_INPUT) {
+      return;
+    }
     cy.getBySel(selector).should('have.value', value);
   });
 
@@ -289,7 +293,7 @@ export const validateOutputTypeChangeToKafka = (outputId: string) => {
   cy.getBySel(SETTINGS_OUTPUTS.TYPE_INPUT).select('kafka');
   cy.getBySel(SETTINGS_OUTPUTS_KAFKA.AUTHENTICATION_USERNAME_PASSWORD_OPTION).click();
 
-  fillInKafkaOutputForm();
+  fillInKafkaOutputForm(true);
   cy.intercept('PUT', '**/api/fleet/outputs/**').as('saveOutput');
 
   cy.getBySel(SETTINGS_SAVE_BTN).click();
diff --git a/x-pack/plugins/fleet/server/saved_objects/index.ts b/x-pack/plugins/fleet/server/saved_objects/index.ts
index c470140d8ac23..b1fa2c0e462ee 100644
--- a/x-pack/plugins/fleet/server/saved_objects/index.ts
+++ b/x-pack/plugins/fleet/server/saved_objects/index.ts
@@ -697,6 +697,7 @@ export function registerEncryptedSavedObjects(
       'timeout',
       'broker_timeout',
       'required_acks',
+      'secrets',
     ]),
   });
   // Encrypted saved objects