I think you need to migrate existing string passwords to Secret passwords in the readResolve method.
Not sure if it will work at all. Probably you need to keep the old field and introduce a new one as Secret.
Otherwise Java deseralisation will probably break.