diff --git a/api/core/helper/encrypter.py b/api/core/helper/encrypter.py
index 181c1b977b..13f1024eec 100644
--- a/api/core/helper/encrypter.py
+++ b/api/core/helper/encrypter.py
@@ -55,7 +55,7 @@ def decrypt_token_with_decoding(token: str, rsa_key, cipher_rsa):
 @overload
 def encrypt_secret_keys(
     obj: Mapping[str, Any],
-    secret_variables: list[str] | None = None,
+    secret_variables: set[str] | None = None,
     parent_key: str | None = None,
 ) -> Mapping[str, Any]: ...
 
@@ -63,7 +63,7 @@ def encrypt_secret_keys(
 @overload
 def encrypt_secret_keys(
     obj: list[Any],
-    secret_variables: list[str] | None = None,
+    secret_variables: set[str] | None = None,
     parent_key: str | None = None,
 ) -> list[Any]: ...
 
@@ -71,21 +71,22 @@ def encrypt_secret_keys(
 @overload
 def encrypt_secret_keys(
     obj: Any,
-    secret_variables: list[str] | None = None,
+    secret_variables: set[str] | None = None,
     parent_key: str | None = None,
 ) -> Any: ...
 
 
 def encrypt_secret_keys(
     obj: Any,
-    secret_variables: list[str] | None = None,
+    secret_variables: set[str] | None = None,
     parent_key: str | None = None,
 ) -> Any:
     """
     Recursively obfuscate the value if it belongs to a Secret Variable.
     Preserves input type: dict -> dict, list -> list, scalar -> scalar.
     """
-    secret_variables = secret_variables or []
+    if secret_variables is None:
+        secret_variables = set()
 
     if isinstance(obj, dict):
         # recurse into dict
diff --git a/api/core/workflow/nodes/agent/agent_node.py b/api/core/workflow/nodes/agent/agent_node.py
index c7643854e6..3ad26ea0ba 100644
--- a/api/core/workflow/nodes/agent/agent_node.py
+++ b/api/core/workflow/nodes/agent/agent_node.py
@@ -144,11 +144,11 @@ class AgentNode(Node):
         env_vars = self.graph_runtime_state.variable_pool.variable_dictionary.get("env", {})
 
         # get secret variables used
-        secret_variables = [
+        secret_variables = {
             var.name
             for var in env_vars.values()  # iterate over the values directly
             if isinstance(var, SecretVariable)
-        ]
+        }
 
         try:
             message_stream = strategy.invoke(
@@ -500,7 +500,7 @@ class AgentNode(Node):
         node_type: NodeType,
         node_id: str,
         node_execution_id: str,
-        secret_variables: list[str] | None = None,
+        secret_variables: set[str] | None = None,
     ) -> Generator[NodeEventBase, None, None]:
         """
         Convert ToolInvokeMessages into tuple[plain_text, files]
diff --git a/api/core/workflow/nodes/code/code_node.py b/api/core/workflow/nodes/code/code_node.py
index a5ef001c2f..41ad3ceab3 100644
--- a/api/core/workflow/nodes/code/code_node.py
+++ b/api/core/workflow/nodes/code/code_node.py
@@ -76,7 +76,7 @@ class CodeNode(Node):
         code = self._node_data.code
 
         # to store secret variables used in the code block.
-        secret_variables = []
+        secret_variables = set()
 
         # Get variables
         variables = {}
@@ -84,7 +84,7 @@ class CodeNode(Node):
             variable_name = variable_selector.variable
             variable = self.graph_runtime_state.variable_pool.get(variable_selector.value_selector)
             if isinstance(variable, SecretVariable):
-                secret_variables.append(variable_name)
+                secret_variables.add(variable_name)
 
             if isinstance(variable, ArrayFileSegment):
                 variables[variable_name] = [v.to_dict() for v in variable.value] if variable.value else None