diff --git a/docs/resources/agent.md b/docs/resources/agent.md
index c20171ba..4c24e244 100644
--- a/docs/resources/agent.md
+++ b/docs/resources/agent.md
@@ -55,6 +55,6 @@ resource "kubernetes_pod" "dev" {
 
 - `id` (String) The ID of this resource.
 - `init_script` (String) Run this script on startup of an instance to initialize the agent.
-- `token` (String) Set the environment variable "CODER_AGENT_TOKEN" with this token to authenticate an agent.
+- `token` (String, Sensitive) Set the environment variable "CODER_AGENT_TOKEN" with this token to authenticate an agent.
 
 
diff --git a/docs/resources/metadata.md b/docs/resources/metadata.md
index 9fcd1de3..16c8e6be 100644
--- a/docs/resources/metadata.md
+++ b/docs/resources/metadata.md
@@ -56,6 +56,7 @@ resource "coder_metadata" "pod_info" {
 ### Optional
 
 - `hide` (Boolean) Hide the resource from the UI.
+- `icon` (String) A URL to an icon that will display in the dashboard. View built-in icons here: https://github.com/coder/coder/tree/main/site/static/icon. Use a built-in icon with `data.coder_workspace.me.access_url + "/icons/<path>"`.
 
 ### Read-Only
 
diff --git a/internal/provider/provider.go b/internal/provider/provider.go
index 487707d0..2829ed50 100644
--- a/internal/provider/provider.go
+++ b/internal/provider/provider.go
@@ -213,7 +213,11 @@ func New() *schema.Provider {
 					}
 					return updateInitScript(resourceData, i)
 				},
-				ReadContext: func(c context.Context, resourceData *schema.ResourceData, i interface{}) diag.Diagnostics {
+				ReadWithoutTimeout: func(c context.Context, resourceData *schema.ResourceData, i interface{}) diag.Diagnostics {
+					err := resourceData.Set("token", uuid.NewString())
+					if err != nil {
+						return diag.FromErr(err)
+					}
 					return updateInitScript(resourceData, i)
 				},
 				DeleteContext: func(c context.Context, rd *schema.ResourceData, i interface{}) diag.Diagnostics {
@@ -267,6 +271,7 @@ func New() *schema.Provider {
 					},
 					"token": {
 						ForceNew:    true,
+						Sensitive:   true,
 						Description: `Set the environment variable "CODER_AGENT_TOKEN" with this token to authenticate an agent.`,
 						Type:        schema.TypeString,
 						Computed:    true,