diff --git a/k8s/test/integration-test-secrets.enc.yaml b/k8s/test/integration-test-secrets.enc.yaml
new file mode 100644
index 0000000..fe2e05a
--- /dev/null
+++ b/k8s/test/integration-test-secrets.enc.yaml
@@ -0,0 +1,27 @@
+# Integration Test Secrets (SOPS Encrypted)
+# This file is encrypted with age/SOPS - never commit plaintext secrets
+# 
+# Decrypt: sops -d k8s/test/integration-test-secrets.enc.yaml
+# Encrypt: sops k8s/test/integration-test-secrets.yaml
+#
+# Contains:
+#   - KUBECONFIG for integration test runner (if needed)
+#   - Database credentials (referenced from cluster secrets, not stored here)
+#   - Registry credentials (optional, for image pull)
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: integration-test-secrets
+  namespace: poimen
+  labels:
+    app: poimen-memory
+    test: integration
+type: Opaque
+data:
+  # Base64 encoded values encrypted by SOPS
+  # Use: kubectl create secret generic integration-test-secrets --from-literal=key=value --dry-run=client -o yaml | sops -e /dev/stdin > this file
+  
+  # Leave empty - credentials come from cluster secrets
+  # This file serves as a template/placeholder for SOPS encryption practice
+  placeholder: "THIS_FILE_IS_ENCRYPTED_BY_SOPS_DO_NOT_COMMIT_PLAINTEXT"