diff --git a/src/Auth/AugmentedUser.php b/src/Auth/AugmentedUser.php
index b4369143432..9852301dd22 100644
--- a/src/Auth/AugmentedUser.php
+++ b/src/Auth/AugmentedUser.php
@@ -25,6 +25,7 @@ public function keys()
             ->merge($this->roleHandles())
             ->merge($this->groupHandles())
             ->merge($this->blueprintFields()->keys())
+            ->diff(['two_factor_secret', 'two_factor_recovery_codes', 'two_factor_confirmed_at'])
             ->unique()->sort()->values()->all();
     }
 
diff --git a/tests/Auth/AugmentedUserTest.php b/tests/Auth/AugmentedUserTest.php
index 90c6e0fb70f..bc4dd3b655a 100644
--- a/tests/Auth/AugmentedUserTest.php
+++ b/tests/Auth/AugmentedUserTest.php
@@ -3,8 +3,11 @@
 namespace Tests\Auth;
 
 use Carbon\Carbon;
+use PHPUnit\Framework\Attributes\DataProvider;
 use PHPUnit\Framework\Attributes\Test;
 use Statamic\Auth\AugmentedUser;
+use Statamic\Auth\TwoFactor\EnableTwoFactorAuthentication;
+use Statamic\Facades\Antlers;
 use Statamic\Facades\Blueprint;
 use Statamic\Facades\User;
 use Tests\Data\AugmentedTestCase;
@@ -89,4 +92,29 @@ public function it_gets_values()
 
         $this->assertAugmentedCorrectly($expectations, $augmented);
     }
+
+    #[Test]
+    #[DataProvider('twoFactorKeysProvider')]
+    public function it_doesnt_augment_two_factor_keys(string $key)
+    {
+        $user = tap(User::make()->email('john@example.com'))->save();
+
+        app(EnableTwoFactorAuthentication::class)($user);
+        $user->set('two_factor_confirmed_at', now()->timestamp);
+
+        $augmented = new AugmentedUser($user);
+
+        $this->assertNotContains($key, $augmented->keys());
+        $this->assertNotContains($key, $augmented->select()->keys()->all());
+        $this->assertSame('', (string) Antlers::parse("{{ current_user:{$key} }}", ['current_user' => $user], true));
+    }
+
+    public static function twoFactorKeysProvider(): array
+    {
+        return [
+            'secret' => ['two_factor_secret'],
+            'recovery codes' => ['two_factor_recovery_codes'],
+            'confirmed at' => ['two_factor_confirmed_at'],
+        ];
+    }
 }