diff --git a/frontend/src/components/Flow/NodePanel.tsx b/frontend/src/components/Flow/NodePanel.tsx
index a1eec1c..a49e6f6 100644
--- a/frontend/src/components/Flow/NodePanel.tsx
+++ b/frontend/src/components/Flow/NodePanel.tsx
@@ -815,7 +815,12 @@ function ParamsForm({
   >
   const entries = Object.entries(properties)
 
-  const { data: secretList } = useQuery(secretsQueryOptions())
+  // Secret names are a superuser's to read; anyone else has none to offer.
+  const { user } = useAuth()
+  const { data: secretList } = useQuery({
+    ...secretsQueryOptions(),
+    enabled: Boolean(user?.is_superuser),
+  })
   const secrets = secretList?.data ?? []
   // A type with nothing to fill in has nothing to suggest, and the other flows
   // are not worth reading for it.