diff --git a/playwright/e2e-tests/secrets.spec.ts b/playwright/e2e-tests/secrets.spec.ts
new file mode 100644
index 0000000000..b5c1530f19
--- /dev/null
+++ b/playwright/e2e-tests/secrets.spec.ts
@@ -0,0 +1,37 @@
+import { expect, test } from '@playwright/test'
+import { clientURL, signInCloudPiNative, testUser } from 'config/console'
+import { openMyProjects } from 'helpers/navigation'
+import { createProject, deleteProject } from 'helpers/project'
+
+// Parcours secrets du projet : bascule du bouton « Afficher/Cacher les secrets
+// des services ». Le cas projet verrouillé (bouton indisponible) n'est pas
+// couvert — la stack CI ne provisionne pas de projet verrouillé.
+test.describe('Secrets du projet', { tag: '@e2e' }, () => {
+  let projectName: string
+
+  test.beforeEach(async ({ page }) => {
+    await page.goto(clientURL)
+    await signInCloudPiNative({ page, credentials: testUser })
+    const { name } = await createProject({ page })
+    projectName = name
+  })
+
+  test('toggling switches the label between show/hide', async ({ page }) => {
+    await openMyProjects({ page })
+    await page.getByRole('link', { name: projectName }).click()
+
+    const toggle = page.getByRole('button', { name: 'Afficher les secrets des services' })
+    await expect(toggle).toBeVisible()
+    await toggle.click()
+    await expect(page.getByRole('button', { name: 'Cacher les secrets des services' })).toBeVisible()
+    await page.getByRole('button', { name: 'Cacher les secrets des services' }).click()
+    await expect(page.getByRole('button', { name: 'Afficher les secrets des services' })).toBeVisible()
+  })
+
+  test.afterEach(async ({ page }) => {
+    if (!projectName)
+      return
+    await deleteProject({ page, projectName })
+    projectName = ''
+  })
+})
diff --git a/playwright/integration-tests/user-flow.spec.ts b/playwright/integration-tests/user-flow.spec.ts
index a27b10139b..7cc2ff733f 100644
--- a/playwright/integration-tests/user-flow.spec.ts
+++ b/playwright/integration-tests/user-flow.spec.ts
@@ -95,6 +95,21 @@ test.describe('Integration tests user flow: first checks', { tag: '@integ' }, ()
     await expect(page1.getByRole('link', { name: 'forge-dso' })).not.toBeVisible()
   })
 
+  test('Check project secrets', { tag: '@replayable' }, async ({ page }) => {
+    await page.goto(clientURL)
+    await signInCloudPiNative({ page, credentials: testUser })
+    await page.getByTestId('menuMyProjects').click()
+    await page.getByRole('link', { name: projectName }).click()
+    await page.getByTestId('showSecretsBtn').click()
+    const modal = page.getByTestId('projectSecretsZone')
+    // Keys only — secret values rotate with the project's provisioning.
+    await expect(modal.getByRole('heading', { name: 'GITLAB' })).toBeVisible()
+    await expect(modal.getByText('GIT_MIRROR_PROJECT_ID')).toBeVisible()
+    await expect(modal.getByText('GIT_MIRROR_TOKEN')).toBeVisible()
+    await expect(modal.locator('pre').first()).not.toBeEmpty()
+    await expect(modal.getByRole('heading', { name: 'VAULT' })).toBeVisible()
+  })
+
   test('Project permissions', async ({ page }) => {
     await page.goto(clientURL)
     await signInCloudPiNative({ page, credentials: testUser })