diff --git a/src/database/session.py b/src/database/session.py
index cd8de62f..c79877c4 100644
--- a/src/database/session.py
+++ b/src/database/session.py
@@ -8,8 +8,9 @@
 logger = logging.getLogger(__name__)
 
 connection_string = settings.database.assemble_db_connection(async_=True)
-logger.debug(f"Database connection string: {connection_string}")
 async_engine = create_async_engine(connection_string, poolclass=NullPool)
+# repr() of a SQLAlchemy URL masks the password.
+logger.debug(f"Database URL: {async_engine.url!r}")
 AsyncSessionLocal: async_sessionmaker[AsyncSession] = async_sessionmaker(
     async_engine, autoflush=True, expire_on_commit=False, class_=AsyncSession
 )
diff --git a/tests/src/database/test_session.py b/tests/src/database/test_session.py
new file mode 100644
index 00000000..04e1ca38
--- /dev/null
+++ b/tests/src/database/test_session.py
@@ -0,0 +1,16 @@
+import importlib
+import logging
+
+from src.core import settings
+from src.database import session
+
+
+def test_creating_the_engine_does_not_log_the_password(caplog, monkeypatch):
+    # The alembic migration tests call logging.config.fileConfig, which disables existing loggers.
+    monkeypatch.setattr(logging.getLogger("src.database.session"), "disabled", False)
+    monkeypatch.setattr(settings.database, "PASSWORD", "not-in-the-logs")
+
+    with caplog.at_level(logging.DEBUG):
+        importlib.reload(session)
+
+    assert "not-in-the-logs" not in caplog.text