diff --git a/app/Services/InfisicalService.php b/app/Services/InfisicalService.php
index 06f1e5d49f..1d3e87e48c 100644
--- a/app/Services/InfisicalService.php
+++ b/app/Services/InfisicalService.php
@@ -39,11 +39,14 @@ class InfisicalService
     {
         $client = $this->client()->withToken($this->login());
         $secretPath = $secretPath ?: '/';
+        // Older Infisical versions do not expand ${KEY} references unless asked to.
+        $valueOptions = ['expandSecretReferences' => 'true', 'viewSecretValue' => 'true'];
 
         $response = $client->get($this->baseUrl.'/api/v4/secrets', [
             'projectId' => $projectId,
             'environment' => $environment,
             'secretPath' => $secretPath,
+            ...$valueOptions,
         ]);
 
         // Older self-hosted instances only expose the v3 endpoint.
@@ -52,6 +55,7 @@ class InfisicalService
                 'workspaceId' => $projectId,
                 'environment' => $environment,
                 'secretPath' => $secretPath,
+                ...$valueOptions,
             ]);
         }
 
diff --git a/tests/Feature/SecretManagers/SecretManagerServicesTest.php b/tests/Feature/SecretManagers/SecretManagerServicesTest.php
index c4e4df36b7..f6a2c34ac3 100644
--- a/tests/Feature/SecretManagers/SecretManagerServicesTest.php
+++ b/tests/Feature/SecretManagers/SecretManagerServicesTest.php
@@ -99,7 +99,9 @@ describe('InfisicalService', function () {
 
         Http::assertSent(fn ($request) => str_contains($request->url(), '/api/v4/secrets')
             && $request->hasHeader('Authorization', 'Bearer short-lived-token')
-            && str_contains($request->url(), 'projectId=project-1'));
+            && str_contains($request->url(), 'projectId=project-1')
+            && $request['expandSecretReferences'] === 'true'
+            && $request['viewSecretValue'] === 'true');
     });
 
     test('falls back to the v3 raw endpoint on older self-hosted instances', function () {
@@ -119,7 +121,8 @@ describe('InfisicalService', function () {
 
         expect($service->fetchSecrets('project-1', 'prod'))->toBe(['LEGACY_KEY' => 'legacy-value']);
 
-        Http::assertSent(fn ($request) => str_contains($request->url(), 'workspaceId=project-1'));
+        Http::assertSent(fn ($request) => str_contains($request->url(), 'workspaceId=project-1')
+            && $request['expandSecretReferences'] === 'true');
     });
 
     test('throws when the login fails', function () {