diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6b106c387..af07bb43e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,6 @@
 ## [Unreleased]
 
+- Handle NPE in integration policy secrets ([#946](https://github.com/elastic/terraform-provider-elasticstack/pull/946))
 - Support multiple group by fields in SLOs ([#870](https://github.com/elastic/terraform-provider-elasticstack/pull/878))
 - Use the auto-generated OAS schema from elastic/kibana for the Fleet API. ([#834](https://github.com/elastic/terraform-provider-elasticstack/issues/834))
 - Support description in `elasticstack_elasticsearch_security_role` data sources. ([#884](https://github.com/elastic/terraform-provider-elasticstack/pull/884))
diff --git a/internal/fleet/integration_policy/secrets.go b/internal/fleet/integration_policy/secrets.go
index 3c266b9dd..0a5ef36a8 100644
--- a/internal/fleet/integration_policy/secrets.go
+++ b/internal/fleet/integration_policy/secrets.go
@@ -104,7 +104,7 @@ func HandleRespSecrets(ctx context.Context, resp *kbapi.PackagePolicy, private p
 	for _, input := range resp.Inputs {
 		handleVars(utils.Deref(input.Vars))
 		for _, stream := range utils.Deref(input.Streams) {
-			handleVars(*stream.Vars)
+			handleVars(utils.Deref(stream.Vars))
 		}
 	}