Secret in shell_command?

I have a shell_command that expects a {{pass}}.

How can I pass a secret from calling action?

  action:
  - data:
      pass: !secret masterpw

Problem: when I save this and come back to the automation, it displays pass: null. And automation.yaml shows pass: (empty).

What might I be doing wrong?
Of course my secrets.yaml contains the entry:

masterpw: test