diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9f7e98dba8d..144c8e886fd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,10 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 - **CUMULUS-2897**
   - Removed unused Systems Manager AWS SDK client. This change removes the Systems Manager client
     from the `@cumulus/aws-client` package.
-    
+- **CUMULUS-3580**
+  - Fixed secret value for `lzards_launchpad_passphrase` which was getting the value from `var.launchpad_passphrase` instead of `var.lzards_launchpad_passphrase`.
+    - This fix will result in a potential unexpected change for users that were somehow using the `launchpad_passphrase` for lzards authentication, with an incorrect `lzards_launchpad_passphrase` defined. Users should verify their production configuration to ensure this fix doesn't result in an unexpected failure due to misconfiguration.
+
 ### Changed
 
 - **CUMULUS-3245**
@@ -25,16 +28,15 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
     terraform configuration value or utilize `lzardsProvider` as part of the task
     workflow configuration
   - Minor refactor of `@cumulus/lzards-api-client` to:
-   - Use proper ECMAScript import for `@cumulus/launchpad-auth`
-   - Update incorrect docstring
-
-### Changed
-
+    - Use proper ECMAScript import for `@cumulus/launchpad-auth`
+    - Update incorrect docstring
 - **CUMULUS-3497**
   - Updated `example/cumulus-tf/orca.tf` to use v9.0.4
 - **CUMULUS-3527**
   - Added suppport for additional kex algorithms in the sftp-client.
 
+### Fixed
+
 ## [v18.2.0] 2023-02-02
 
 ### Migration Notes
diff --git a/tf-modules/ingest/lzards-backup-task.tf b/tf-modules/ingest/lzards-backup-task.tf
index 9c255b55cce..51bbb838714 100644
--- a/tf-modules/ingest/lzards-backup-task.tf
+++ b/tf-modules/ingest/lzards-backup-task.tf
@@ -99,7 +99,7 @@ resource "aws_secretsmanager_secret" "lzards_launchpad_passphrase" {
 resource "aws_secretsmanager_secret_version" "lzards_launchpad_passphrase" {
   count         = length(var.lzards_launchpad_passphrase) == 0 ? 0 : 1
   secret_id     = aws_secretsmanager_secret.lzards_launchpad_passphrase[0].id
-  secret_string = var.launchpad_passphrase
+  secret_string = var.lzards_launchpad_passphrase
 }
 
 data "aws_iam_policy_document" "lzards_processing_role_get_secrets" {