diff --git a/content/docs/agent-runtime/workspace-runtime.md b/content/docs/agent-runtime/workspace-runtime.md
index 852fbf7..fa59694 100644
--- a/content/docs/agent-runtime/workspace-runtime.md
+++ b/content/docs/agent-runtime/workspace-runtime.md
@@ -149,7 +149,7 @@ External workspaces run outside the platform's Docker infrastructure — on your
 | Liveness | Docker health sweep | Heartbeat TTL (90s offline threshold) |
 | Registration | Automatic at container start | Manual: `POST /workspaces` + `POST /registry/register` |
 | Token | Inherited from container env | Minted at registration, shown once |
-| Secrets | Baked in image or env var | Pulled from platform at boot via `GET /workspaces/:id/secrets/values` |
+| Secrets | Baked in image or env var | Pulled from platform at boot via `GET /workspaces/:id/secrets` |
 
 ### Registration flow
 
@@ -190,7 +190,7 @@ The platform returns a 256-bit bearer token — save it, it is shown only once.
 **3. Pull secrets at boot:**
 
 ```bash
-curl http://localhost:8080/workspaces/ws-xyz/secrets/values \
+curl http://localhost:8080/workspaces/ws-xyz/secrets \
   -H "Authorization: Bearer <your-token>"
 ```
 
diff --git a/content/docs/guides/remote-workspaces.md b/content/docs/guides/remote-workspaces.md
index 742b691..e62f428 100644
--- a/content/docs/guides/remote-workspaces.md
+++ b/content/docs/guides/remote-workspaces.md
@@ -69,7 +69,7 @@ Laptop (remote agent)                Molecule AI Platform
   │  POST /registry/register  ────────────► │  ← admin token (one-time)
   │  ←─ auth_token (256-bit)  ◄────────── │  ← shown once, saved to disk
   │                                        │
-  │  GET /workspaces/:id/secrets/values     │  ← bearer: auth_token
+  │  GET /workspaces/:id/secrets              │  ← bearer: auth_token
   │  POST /registry/heartbeat  (30s loop)  │
   │  GET  /workspaces/:id/state  (30s loop)│
   │                                        │
@@ -135,7 +135,7 @@ The agent appears on the canvas with a **purple REMOTE badge** within seconds. F
 | Phase | What shipped | Endpoint |
 |---|---|---|
 | 30.1 | Workspace auth tokens | `POST /registry/register`, `POST /registry/heartbeat` |
-| 30.2 | Token-gated secrets pull | `GET /workspaces/:id/secrets/values` |
+| 30.2 | Token-gated secrets pull | `GET /workspaces/:id/secrets` |
 | 30.3 | Plugin tarball download (remote install) | `GET /plugins/:name/download` |
 | 30.4 | Workspace state polling (no WebSocket needed) | `GET /workspaces/:id/state` |
 | 30.5 | A2A proxy enforces caller token | `POST /workspaces/:id/a2a` |