diff --git a/tests/contract/package/admin-package.test.ts b/tests/contract/package/admin-package.test.ts
index ba0dc95..4605213 100644
--- a/tests/contract/package/admin-package.test.ts
+++ b/tests/contract/package/admin-package.test.ts
@@ -2,6 +2,7 @@ import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { extname, join, relative, resolve } from 'node:path';
 import { describe, expect, it } from 'vitest';
+import { parse } from 'yaml';
 import adminPlugin, { ADMIN_CAPABILITIES, ADMIN_ENV_SCHEMA } from '../../../src/plugin';
 import type { PluginSiteContext, SiteExtensionContribution } from '@treeseed/sdk/site-contracts/plugin';
 import { ADMIN_ROUTES, ADMIN_SUPPORT_ROUTES } from '../../../src/routes';
@@ -400,6 +401,13 @@ describe('@treeseed/admin identity and team surface', () => {
 		expect(existsSync('src/config.yaml')).toBe(true);
 	});
 
+	it('restores the required browser workload credential through declared development custody', () => {
+		const manifest = parse(readFileSync('treeseed.package.yaml', 'utf8'));
+		const web = manifest.development.targets.find((target: { id: string }) => target.id === 'web');
+		expect(web.secretRefs).toEqual({ TREESEED_IDENTITY_WORKLOAD_PRIVATE_KEY: 'identity-admin-workload' });
+		expect(web.operations.start.environment).not.toHaveProperty('TREESEED_IDENTITY_WORKLOAD_PRIVATE_KEY');
+	});
+
 	it('publishes its package-owned guarantee catalog and verifier declarations', () => {
 		const packageJson = JSON.parse(readFileSync('package.json', 'utf8')) as { files?: string[] };
 		const manifest = readFileSync('treeseed.package.yaml', 'utf8');
diff --git a/treeseed.package.yaml b/treeseed.package.yaml
index 509cb18..ac4d13a 100644
--- a/treeseed.package.yaml
+++ b/treeseed.package.yaml
@@ -50,7 +50,7 @@ development:
         - { id: api, target: service, capability: control-plane-api, locality: either, reaction: none }
       statePolicy: stateless
       migrationPolicy: none
-      secretRefs: {}
+      secretRefs: { TREESEED_IDENTITY_WORKLOAD_PRIVATE_KEY: identity-admin-workload }
       shutdown: { graceSeconds: 15, activeWorkPolicy: block }
       resources: {}
       logs: [.treeseed/development/web.log]