From 2f0bb657e2b01724452014067c106ae80a3d9488 Mon Sep 17 00:00:00 2001
From: Zach <3724288+zedkipp@users.noreply.github.com>
Date: Wed, 17 Jun 2026 14:52:07 -0600
Subject: [PATCH] docs: note Database Encryption coverage for user secrets
 (#26435)

---
 docs/admin/security/database-encryption.md |  7 ++++---
 docs/admin/security/secrets.md             |  4 +++-
 docs/user-guides/user-secrets.md           | 12 ++++++++++--
 3 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/docs/admin/security/database-encryption.md b/docs/admin/security/database-encryption.md
index dd8b536f7c..72a7c02843 100644
--- a/docs/admin/security/database-encryption.md
+++ b/docs/admin/security/database-encryption.md
@@ -1,8 +1,9 @@
 # Database Encryption
 
-By default, Coder stores external user tokens in plaintext in the database.
-Database Encryption allows Coder administrators to encrypt these tokens at-rest,
-preventing attackers with database access from using them to impersonate users.
+By default, Coder stores external user tokens and other sensitive values in
+plaintext in the database. Database Encryption allows Coder administrators to
+encrypt these values at-rest, preventing attackers with database access from
+reading or misusing them.
 
 ## How it works
 
diff --git a/docs/admin/security/secrets.md b/docs/admin/security/secrets.md
index 2b4899c163..b7d9285fff 100644
--- a/docs/admin/security/secrets.md
+++ b/docs/admin/security/secrets.md
@@ -49,7 +49,9 @@ Users can view their public key in their account settings:
 User secrets are developer-managed values that Coder injects at workspace start.
 If a user secret targets the same environment variable name or file path as a
 template-provided variable or file, Coder injects the user secret into that
-workspace. See the [User secrets guide](../../user-guides/user-secrets.md).
+workspace. User secret values are covered by
+[Database Encryption](./database-encryption.md) when it is enabled. See the
+[User secrets guide](../../user-guides/user-secrets.md).
 
 ## Dynamic Secrets
 
diff --git a/docs/user-guides/user-secrets.md b/docs/user-guides/user-secrets.md
index 7f2aca20af..d0b4d5d520 100644
--- a/docs/user-guides/user-secrets.md
+++ b/docs/user-guides/user-secrets.md
@@ -29,6 +29,13 @@ create or update them.
 > that workspace. Do not share a workspace that has injected secrets with users
 > who should not access those values.
 
+### Storage and encryption
+
+Coder stores user secret values in the database. When
+[database encryption](../admin/security/database-encryption.md) is enabled,
+Coder encrypts secret values at rest. Otherwise, values are stored in plaintext
+in the database.
+
 ## How your secrets reach a workspace
 
 Coder applies your secrets when your workspace starts. The same applies any
@@ -103,8 +110,9 @@ the env aggregate could never be injected successfully as an environment
 variable.
 
 These caps measure stored bytes, which is what Coder writes to the database.
-In deployments with secret encryption enabled, stored bytes exceed the raw
-value.
+In deployments with
+[database encryption](../admin/security/database-encryption.md) enabled,
+stored bytes exceed the raw value.
 
 ## Manage secrets from the dashboard