diff --git a/workspace-server/internal/handlers/secrets.go b/workspace-server/internal/handlers/secrets.go
index 43a8a0d7..84f6f38c 100644
--- a/workspace-server/internal/handlers/secrets.go
+++ b/workspace-server/internal/handlers/secrets.go
@@ -63,6 +63,9 @@ func (h *SecretsHandler) List(c *gin.Context) {
 			"updated_at": updatedAt,
 		})
 	}
+	if err := rows.Err(); err != nil {
+		log.Printf("List secrets rows.Err: %v", err)
+	}
 
 	// 2. Global secrets not overridden at workspace level
 	globalRows, err := db.DB.QueryContext(ctx,
@@ -91,6 +94,9 @@ func (h *SecretsHandler) List(c *gin.Context) {
 			"updated_at": updatedAt,
 		})
 	}
+	if err := globalRows.Err(); err != nil {
+		log.Printf("List secrets (global) rows.Err: %v", err)
+	}
 
 	c.JSON(http.StatusOK, secrets)
 }
@@ -174,6 +180,9 @@ func (h *SecretsHandler) Values(c *gin.Context) {
 				out[k] = string(decrypted)
 			}
 		}
+		if err := globalRows.Err(); err != nil {
+			log.Printf("secrets.Values globalRows.Err: %v", err)
+		}
 	}
 
 	wsRows, wErr := db.DB.QueryContext(ctx,
@@ -195,6 +204,9 @@ func (h *SecretsHandler) Values(c *gin.Context) {
 				out[k] = string(decrypted) // workspace override wins over global
 			}
 		}
+		if err := wsRows.Err(); err != nil {
+			log.Printf("secrets.Values wsRows.Err: %v", err)
+		}
 	}
 
 	if len(failedKeys) > 0 {
@@ -324,6 +336,9 @@ func (h *SecretsHandler) ListGlobal(c *gin.Context) {
 			"scope":      "global",
 		})
 	}
+	if err := rows.Err(); err != nil {
+		log.Printf("ListGlobal rows.Err: %v", err)
+	}
 	c.JSON(http.StatusOK, secrets)
 }
 
@@ -400,6 +415,9 @@ func (h *SecretsHandler) restartAllAffectedByGlobalKey(key string) {
 			ids = append(ids, id)
 		}
 	}
+	if err := rows.Err(); err != nil {
+		log.Printf("restartAllAffectedByGlobalKey rows.Err: %v", err)
+	}
 	if len(ids) == 0 {
 		return
 	}