diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index 743f337..d4df535 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -43,7 +43,7 @@ permissions:
 env:
   INFRA_DIR: tests/infrastructure
   SCRIPTS_DIR: tests/infrastructure/scripts
-  PVE_PASSWORD: "Testpass123!"
+  PVE_PASSWORD: ${{ secrets.PVE_TEST_PASSWORD }}
   TEST_IMAGE: ghcr.io/goodolclint/psproxmoxve-integration
   CACHE_DIR: /opt/pve-isos
 
diff --git a/.gitignore b/.gitignore
index 299ae03..f19e575 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,3 +11,5 @@ nupkg/
 *.ps1xml.bak
 *.DotSettings.user
 BenchmarkDotNet.Artifacts/
+.env
+.env.*
diff --git a/tests/PSProxmoxVE.Tests/Integration/README.md b/tests/PSProxmoxVE.Tests/Integration/README.md
index d743150..ed3dcd1 100644
--- a/tests/PSProxmoxVE.Tests/Integration/README.md
+++ b/tests/PSProxmoxVE.Tests/Integration/README.md
@@ -66,7 +66,7 @@ required variable causes every integration test to be skipped with a clear reaso
 | `PVETEST_NODE`           | Yes      | Node name as it appears in `pvesh get /nodes`                        | `pve-test1`                                         |
 | `PVETEST_STORAGE`        | Yes      | Storage pool to use for disk and ISO operations                       | `local`                                             |
 | `PVETEST_ISO_PATH`       | Yes      | Local path to a small `.iso` file used for upload tests               | `/tmp/tinycorelinux.iso`                            |
-| `PVETEST_PASSWORD`       | No       | Root password for cloud-init Linux VM provisioning                    | `Testpass123!`                                      |
+| `PVETEST_PASSWORD`       | No       | Root password for cloud-init Linux VM provisioning                    | *(use a strong password)*                           |
 | `PVETEST_CLOUD_IMAGE_URL`| No      | URL for cloud image download (defaults to Ubuntu Noble)               | `https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img` |
 | `PVETEST_PVE_VERSION`    | No       | Expected PVE major version (8 or 9)                                   | `9`                                                 |
 
@@ -80,7 +80,7 @@ export PVETEST_NODE="pve-test1"
 export PVETEST_STORAGE="local"
 export PVETEST_ISO_PATH="/tmp/tinycorelinux.iso"
 # Optional — required for Linux VM provisioning tests
-export PVETEST_PASSWORD="Testpass123!"
+export PVETEST_PASSWORD="<your-test-password>"
 ```
 
 ### Setting variables (PowerShell)
@@ -93,7 +93,7 @@ $env:PVETEST_NODE      = 'pve-test1'
 $env:PVETEST_STORAGE   = 'local'
 $env:PVETEST_ISO_PATH  = '/tmp/tinycorelinux.iso'
 # Optional — required for Linux VM provisioning tests
-$env:PVETEST_PASSWORD  = 'Testpass123!'
+$env:PVETEST_PASSWORD  = '<your-test-password>'
 ```
 
 ### GitHub Actions / CI
diff --git a/tests/infrastructure/scripts/create-api-token.sh b/tests/infrastructure/scripts/create-api-token.sh
index cdad15c..d89bfb9 100755
--- a/tests/infrastructure/scripts/create-api-token.sh
+++ b/tests/infrastructure/scripts/create-api-token.sh
@@ -3,7 +3,7 @@
 # then wait for the PVE API and create an API token.
 #
 # Usage: create-api-token.sh <parent-pve-endpoint> <parent-api-token> <vm-id> <root-password> [max-wait-seconds]
-#   parent-pve-endpoint: Full URL e.g. https://172.16.100.150:8006
+#   parent-pve-endpoint: Full URL e.g. https://pve.example.com:8006
 #   Outputs two lines:
 #     IP=<discovered-ip>
 #     TOKEN=root@pam!integration=<secret>
diff --git a/tests/infrastructure/variables.tf b/tests/infrastructure/variables.tf
index 5de8149..18864c3 100644
--- a/tests/infrastructure/variables.tf
+++ b/tests/infrastructure/variables.tf
@@ -66,8 +66,7 @@ variable "network_bridge" {
 }
 
 variable "test_vm_password" {
-  description = "Root password for the nested PVE instances"
+  description = "Root password for the nested PVE instances. Set via TF_VAR_test_vm_password env var."
   type        = string
   sensitive   = true
-  default     = "Testpass123!"
 }