Credential in PPD file: Is there a way to hide it?

We have a copying machine that can be used as a printer. In order to do that, I have to provide a credential in plain in the Xerox.ppd file. Problem: Any user on the system can grep credential /etc/cups/ppd/Xerox.ppd no matter if CUPS allows him to use that printer. Being more restrictive on the file permissions of that file makes it impossible for users to set options like paper format and duplex/simplex, so that's no option. For example, I want lpoptions -l to keep working. Is there a way to overcome this?