diff --git a/CHANGELOG.md b/CHANGELOG.md
index 27af4305a..2e96e9c60 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,9 @@ CHANGELOG
 
 ## HEAD (unreleased)
 
+- Order secretOutputNames when used in stack references
+  [#4481](https://github.com/pulumi/pulumi/pull/4481)
+
 - Add support for a `PULUMI_CONSOLE_DOMAIN` environment variable to override the
   behavior for how URLs to the Pulumi Console are generated.
   [#4410](https://github.com/pulumi/pulumi/pull/4410)
diff --git a/pkg/resource/deploy/builtins.go b/pkg/resource/deploy/builtins.go
index 59d0f5ac6..d6d18cd54 100644
--- a/pkg/resource/deploy/builtins.go
+++ b/pkg/resource/deploy/builtins.go
@@ -3,6 +3,7 @@ package deploy
 import (
 	"context"
 	"fmt"
+	"sort"
 
 	"github.com/pkg/errors"
 	uuid "github.com/satori/go.uuid"
@@ -209,6 +210,11 @@ func (p *builtinProvider) readStackReference(inputs resource.PropertyMap) (resou
 		}
 	}
 
+	// Sort the secret outputs
+	sort.Slice(secretOutputs, func(i, j int) bool {
+		return secretOutputs[i].String() < secretOutputs[j].String()
+	})
+
 	return resource.PropertyMap{
 		"name":              name,
 		"outputs":           resource.NewObjectProperty(outputs),