diff --git a/server/src/routes/secrets.ts b/server/src/routes/secrets.ts
index 6fe1b7ecf7e..cba2fe09d7b 100644
--- a/server/src/routes/secrets.ts
+++ b/server/src/routes/secrets.ts
@@ -348,6 +348,10 @@ export function secretRoutes(db: Db) {
       return;
     }
     assertCompanyAccess(req, existing.companyId);
+    if (existing.status === "deleted") {
+      res.status(404).json({ error: "Secret not found" });
+      return;
+    }
 
     const rotated = await svc.rotate(
       id,