diff --git a/tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/Layout/NavMenuTests.cs b/tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/Layout/NavMenuTests.cs
index f1adf124..0db8780a 100644
--- a/tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/Layout/NavMenuTests.cs
+++ b/tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/Layout/NavMenuTests.cs
@@ -150,6 +150,30 @@ public class NavMenuTests : BunitContext
         });
     }
 
+    [Fact]
+    public void AdminSection_SecretsLink_VisibleForAdministrator()
+    {
+        var cut = RenderWithRoles("Administrator");
+
+        cut.WaitForAssertion(() =>
+        {
+            // Secrets management UI (ZB.MOM.WW.Secrets Secrets.Ui) — Administrator only.
+            Assert.Contains("/admin/secrets", cut.Markup);
+        });
+    }
+
+    [Fact]
+    public void AdminSection_SecretsLink_AbsentForNonAdministrator()
+    {
+        // Designer + Deployer covers every non-admin section without RequireAdmin.
+        var cut = RenderWithRoles("Designer", "Deployer");
+
+        cut.WaitForAssertion(() =>
+        {
+            Assert.DoesNotContain("/admin/secrets", cut.Markup);
+        });
+    }
+
     // ── AuthorizeView-gated SECTION visibility (the GAPS open question) ──────
     // A whole NavRailSection wrapped in <AuthorizeView Policy="..."> must SHOW
     // (heading + items) for an authorized principal and be entirely ABSENT for