diff --git a/src/sdk-client.test.ts b/src/sdk-client.test.ts
index 2b3027d..dea601a 100644
--- a/src/sdk-client.test.ts
+++ b/src/sdk-client.test.ts
@@ -77,6 +77,12 @@ describe("loadSecretsFromSDK", () => {
 		);
 	});
 
+	it("masks the integration key and strips its base64 padding", async () => {
+		await loadSecretsFromSDK(workloadId, environmentId, "integration-key==", false);
+
+		expect(core.setSecret).toHaveBeenCalledWith("integration-key");
+	});
+
 	describe("when secret value is empty string", () => {
 		beforeEach(() => {
 			mockGetVariables.mockResolvedValue({
@@ -93,14 +99,14 @@ describe("loadSecretsFromSDK", () => {
 			);
 
 			expect(core.setOutput).toHaveBeenCalledWith("EMPTY_SECRET", "");
-			expect(core.setSecret).not.toHaveBeenCalled();
+			expect(core.setSecret).not.toHaveBeenCalledWith("");
 		});
 
 		it("sets empty string as environment variable", async () => {
 			await loadSecretsFromSDK(workloadId, environmentId, integrationKey, true);
 
 			expect(core.exportVariable).toHaveBeenCalledWith("EMPTY_SECRET", "");
-			expect(core.setSecret).not.toHaveBeenCalled();
+			expect(core.setSecret).not.toHaveBeenCalledWith("");
 		});
 	});