diff --git a/.changeset/ninety-dolls-wait.md b/.changeset/ninety-dolls-wait.md
new file mode 100644
index 000000000..1fb51a3c6
--- /dev/null
+++ b/.changeset/ninety-dolls-wait.md
@@ -0,0 +1,5 @@
+---
+"@livekit/protocol": patch
+---
+
+Redact external_id field
diff --git a/egress/redact.go b/egress/redact.go
index 2badc20bc..6ab1d8ade 100644
--- a/egress/redact.go
+++ b/egress/redact.go
@@ -9,6 +9,7 @@ func RedactUpload(req UploadRequest) {
 	if s3 := req.GetS3(); s3 != nil {
 		s3.AccessKey = utils.Redact(s3.AccessKey, "{access_key}")
 		s3.Secret = utils.Redact(s3.Secret, "{secret}")
+		s3.AssumeRoleExternalId = utils.Redact(s3.AssumeRoleExternalId, "{external_id}")
 		return
 	}
 
diff --git a/egress/redact_test.go b/egress/redact_test.go
index 5b7412f85..2f0e6d14a 100644
--- a/egress/redact_test.go
+++ b/egress/redact_test.go
@@ -13,8 +13,9 @@ var (
 	file = &livekit.EncodedFileOutput{
 		Output: &livekit.EncodedFileOutput_S3{
 			S3: &livekit.S3Upload{
-				AccessKey: "ACCESS_KEY",
-				Secret:    "LONG_SECRET_STRING",
+				AccessKey:            "ACCESS_KEY",
+				Secret:               "LONG_SECRET_STRING",
+				AssumeRoleExternalId: "EXTERNAL_ID",
 			},
 		},
 	}
@@ -52,6 +53,7 @@ func TestRedactUpload(t *testing.T) {
 
 	require.Equal(t, "{access_key}", cl.(*livekit.EncodedFileOutput).Output.(*livekit.EncodedFileOutput_S3).S3.AccessKey)
 	require.Equal(t, "{secret}", cl.(*livekit.EncodedFileOutput).Output.(*livekit.EncodedFileOutput_S3).S3.Secret)
+	require.Equal(t, "{external_id}", cl.(*livekit.EncodedFileOutput).Output.(*livekit.EncodedFileOutput_S3).S3.AssumeRoleExternalId)
 
 	cl = proto.Clone(image)
 	RedactUpload(cl.(UploadRequest))